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Self 6ty SlJ ITI mSry The following general safety precautions must be observed during all 

phases of operation, service, and repair of this instrument. Failure to 
comply with these precautions or with specific WARNINGS 
elsewhere in this manual may impair the protection provided by the 
equipment. In addition it violates safety standards of design, 
manufacture, and intended use of the instrument. 

The Hewlett-Packard Company assumes no liability for the customer's 
failure to comply with these requirements. 



Note 




HP E3471 A complies with INSTALLATION CATEGORY I and 
POLLUTION DEGREE 2 in IEC1010-1. PRODNO is INDOOR USE 



product. 



DO NOT Operate in 
an Explosive 
Atmosphere 

DO NOT Substitute 
Parts or Modify 
Instrument 



Do not operate the instrument in the presence of flammable gasses or 
fumes. Operation of any electrical instrument in such an environment 
constitutes a safety hazard. 

Because of the danger of introducing additional hazards, do not install 
substitute parts or perform unauthorized modifications to the 
instrument. Return the instrument to a Hewlett-Packard Sales and 
Service Office for service and repair to ensure that safety features are 
maintained. 



Dangerous 
Procedure Warnings 



Warnings , such as the example below, precede potentially dangerous 
procedures throughout this manual. Instructions contained in the 
warnings must be followed. 



Warning 



Dangerous voltages, capable of causing death, are present 
in this instrument. Use extreme caution when handling, 
testing, and adjusting this instrument. 



Safety Symbols 



General definitions of safety symbols used in manuals are listed below. 
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This Warning sign denotes a hazard. If calls attention to a procedure, 
practice, condition or the like, which, if not correctly performed or 
adhered to, could result in injury or death to personnel. 

This Caution sign denotes a hazard. If calls attention to a procedure, 
practice, condition or the like, which, if not correctly performed or 
adhered to, could result in damage to or destruction of part or all of the 
product. 

This Note sign denotes important information. If calls attention to a 
procedure, practice, condition or the like, which is essential to highlight. 



Using This Manual 



This manual is designed to give you an introduction to the HP E3471 
H8S/2000 Emulator. This manual will also help define how these 
emulators differ from other HP 64700 Emulators. 

This manual will: 

■ give you an introduction to using the emulator 

■ explore various ways of applying the emulator to accomplish 
your tasks 

■ show you emulator commands which are specific to the 
H8S/2000 Emulator 

This manual will not: 

■ tell you how to use each and every emulator/analyzer 
command (refer to the User's Reference manual) 



Organization 

Chapter 1 



An introduction to the H8S/2000 emulator features and how they can 
help you in developing new hardware and software. 



Chapter 2 

Chapter 3 
Chapter 4 

Appendix A 



A brief introduction to using the H8S/2000 Emulator. You will load 
and execute a short program, and make some measurements using the 
emulation analyzer. 

How to plug the emulator probe into a target system. 

Configuring the emulator to adapt it to your specific measurement 
needs. 



H8S/2000 Emulator Specific Command Syntax and Error Message 
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Introduction to the H8S/2000 Emulator 

Introduction The topics in this chapter include: 

■ Purpose of the H8S/2000 Emulator 

■ Features of the H8S/2000 Emulator 



Purpose of the 
H8S/2000 Emulator 



The H8S/2000 Emulator is designed to replace the H8S/2000 
microprocessor in your target system so you can control operation of 
the microprocessor in your application hardware (usually refer 
to as the target system). The H8S/2000 emulator performs just like the 
H8S/2000 microprocessor, but is a device that allows you to control the 
H8S/2000 microprocessor directly. These features allow you to easily 
debug software before any hardware is available, and ease the task of 
integrating hardware and software. 



Introduction to the H8S/2000 Emulator 1-1 




Figure 1-1 . HP E3471 Emulator for the H8S/2000 
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Features of the 
H8S/2000 Emulator 



Supported The HP E3471 H8S/2000 emulator supports the microprocessors listed 

Microprocessors in Table 11 



Table 1-1. Supported Microprocessors 



Supported Microprocessor 


OTTT> f^oKlo 1 


Additional 
QFP Socket/Adapter 


Type 


Package 


H8S/2653 


120pin TQFP 


LTD TJ 


rxr lL j4 / 1 -0 1 OZU 


1 9 SPin OFP 




rir HjQI 1-OlOZl 


H8S/2655 


120pin TQFP 


HP E3471B 


HP E347 1-6 1620 


128pin QFP 


HPE3471C 


HP E3471-61621* 2 


H8S/2241 


100 pin TQFP 


HPE3471D 


HPE3471-61622 


lOOpin QFP 


HP E3471D 


HPE3471-61622 


H8S/2242 


100 pin TQFP 


HPE3471D 


HPE3471-61622 


lOOpin QFP 


HP E3471D 


HPE3471-61622 


H8S/2245 


100 pin TQFP 


HPE3471D 


HPE3471-61622 


lOOpin QFP 


HP E3471D 


HPE3471-61622 


H8S/2246 


100 pin TQFP 


HPE3471D 


HPE3471-61622 


lOOpin QFP 


HP E3471D 


HPE3471-61622 



Introduction to the H8S/2000 Emulator 1-3 



* 1 The QFP cable includes one QFP socket/adapter. 

*2 HP E347 1-6 1621 QFP socket/adapter does not include the cap 
required for attaching a microprocessor. To attach the microprocessor, 
you need to purchase the cap (P/N E347 1-6 1631), separately. 

The H8S/2000 emulator is provided with a PGA adapter. To emulate 
each processor with your target system, you need to purchase 
appropriate QFP cable listed in Table 1-1. To purchase them, contact 
your local HP sales representative. 

The list of supported microprocessors in Table 1-1 is not necessarily 
complete. To determine if your microprocessor is supported or not, 
contact Hewlett-Packard. 

Clock Speeds You can select whether the emulator will be clocked by the internal 
clock source or by the external clock source on your target system. 
When you select a clock input as external, you need to conform to the 
specification of Table 1-2. 



Table 1-2. Clock Speeds 



Clock source 


With 64700A 


With 64700B 


Internal 


10MHz 


10MHz 




(System clock) 


(System clock) 


External 


From 2.0MHz up to 20MHz 


From 33kHz up to 20MHz 




(System clock) 


(System clock) 



Note 




When the emulator is connected to the target system operating at low 
voltage (2.7 to 4.5 V), the maximum system clock is 13 MHz. 



1-4 Introduction to the H8S/2000 Emulator 



Emulation memory The H8S/2000 emulator is used with one of the following Emulation 

Memory. 

■ HP 64 172 A 20ns 256K byte Emulation SIMM Memory 

■ HP 64172B 20ns 1M byte Emulation SIMM Memory 

■ HP 64 1 73 A 20ns 4M byte Emulation SIMM Memory 

You can define up to 16 memory ranges (at IK byte boundaries). The 
emulator occupies some emulation memory, which is used for monitor 
program and internal RAM of microprocessor, leaving 248K, 992K, 
3968K byte of emulation memory which you may use. You can 
characterize memory range as emulation RAM (eram), emulation ROM 
(erom), target system RAM (tram), target system ROM (trom), or 
guarded memory (grd). The emulator generates an error message when 
accesses are made to guarded memory locations. You can also 
configure the emulator so that writes to memory defined as ROM cause 
emulator execution to break out of target program execution. 



Analysis The H8S/2000 emulator is used with one of the following analyzers 
which allows you to trace code execution and processor activity. 

■ HP 64704A 80-channel Emulation Bus Analyzer 

■ HP 64794A/C/D Deep Emulation Bus Analyzer 

The Emulation Bus Analyzer monitors the emulation processor using 
an internal analysis bus. 

Registers You can display or modify the H8S/2000 internal register contents. 

This includes the ability to modify the program counter (PC) value so 
you can control where the emulator starts a program run. 

Breakpoints You can set the emulator/analyzer interaction so the emulator will 

break to the monitor program when the analyzer finds a specific state or 
states, allowing you to perform post-mortem analysis of the program 
execution. You can also set software breakpoints in your program. 
This feature is realized by inserting a special instruction into user 
program. One of undefined opcodes (5770 hex) is used as software 
breakpoint instruction. Refer to the "Using Software Breakpoints" 
section of "Getting Started" chapter for more information. 



Reset Support The emulator can be reset from the emulation system under your 
control; or your target system can reset the emulation processor. 
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Real Time Operation Real-time signifies continuous execution of your program at full rated 

processor speed without interference from the emulator. (Such 
interference occurs when the emulator needs to break to the monitor to 
perform an action you requested, such as displaying target system 
memory.) Emulator features performed in real time include: running 
and analyzer tracing. Emulator features not performed in real time 
include: display or modification of target system memory, load/dump 
of target memory, display or modification of registers. 
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Limitations, 
Restrictions 



DMA Support 



Direct memory access to the emulation memory by the external DMAC 
is not allowed. Single-mode transfer to the emulation memory by the 
internal DMAC also is not supported. 



Burst ROM Do not map the burst ROM space with the 1 -state burst cycle as the 
emulation memory. 



Write Data Buffer 
Function 



Do not use the write data buffer function for the emulation memory. 
When using the emulation memory, do not set the write data buffer 
enable bit in the bus control register L (BCRL). 



EEPMOV A break command, issued during the execution of the "EEPMOV" 
command, is suspended and occurs after the execution is completed. 



Watch Dog Timer in 
Background 



Watch dog timer is suspended count up while the emulator is running 
in the background monitor. 



Monitor Break at When the emulator breaks into the background monitor, sleep or 
Sleep/Standby Mode software standby mode is released. Then, PC indicates next address of 

"SLEEP" instruction. 

Hardware Standby Hardware standby mode is not supported for the H8S/2000 emulator. 

Mode Hardware standby request from the target system will give the reset 
signal to the emulator. 

Interrupts in The H8S/2000 emulator does not accept any interrupts while in the 
Background Cycles background monitor. Such interrupts are suspended while running the 

background monitor, and will occur when context is changed to 
foreground. 
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Evaluation Chip Hewlett-Packard makes no warranty of the problem caused by the 
H8S/2000 Evaluation chip in the emulator. 
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Getting Started 



Introduction This chapter will lead you through a basic, step by step tutorial 

designed to familiarize you with the use of the HP 64700 emulator for 
the H8S/2000 microprocessor. When you have completed this chapter, 
you will be able to perform these tasks: 

■ Set up an emulation configuration for out of circuit emulation 
use 

■ Map memory 

■ Transfer a small program into emulation memory 

■ Use run/stop controls to control operation of your program 

■ Use memory manipulation features to alter the program' s 
operation 

■ Use analyzer commands to view the real time execution of 
your program 

■ Use software breakpoint feature to stop program execution at 
specific address 

■ Search memory for strings or numeric expressions 

■ Make program coverage measurements 
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Before You Begin Before beginning the tutorial presented in this chapter, you must have 

completed the following tasks: 



1. Completed hardware installation of the HP 64700 emulator in 
the configuration you intend to use for your work: 

Standalone configuration 

Remote configuration 

2. If you are using the Remote Configuration, you must have 
completed installation and configuration of a terminal 
emulator program which will allow your host to act as a 
terminal connected to the emulator. In addition, you must start 
the terminal emulator program before you can work the 
examples in this chapter. 

3. If you have properly completed steps 1 and 2 above, you 
should be able to hit <RETURN> (or <ENTER> on some 
keyboards) and get one of the following command prompts on 
your terminal screen: 

U> 
R> 
M> 

If you do not see one of these command prompts, retrace your 
steps through the hardware and software installation 
procedures outlined in the manuals above, verifying all 
connections and procedural steps. If you are still unable to get 
a command prompt, refer to the HP 64700 Support Services 
Guide. The guide gives basic troubleshooting procedures. If 
this fails, call the local HP sales and service office listed in the 
Support Services Guide. 

In any case, you must have a command prompt on your 
terminal screen before proceeding with the tutorial. 



A LOOk at the The sample program "COMMAND_READER" used in this chapter is 

Sample Program shown figure 2-1. The program emulates a primitive command 



interpreter. 
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Data Declarations 

Msg_A, Msg_B and Msg_I are the messages used by the program to 
respond to various command inputs. 

Initialization 

The locations of stack and input area(Cmd_Input) are moved into 
address registers for use by the program. Next, the CLEAR routine 
clears the command byte(the first location pointed to by Cmd_Input - 
OfffOOO hex). Cmd_Input contains 00 hex for late use. 

Scan 

This routine continuously reads the byte at location of Cmd_Input until 
it is something other than a null character (00 hex); when this occurs, 
the Exe_Cmd routine is executed. 

Exe_Cmd 

Compares the input byte (now something other than a null) to the 
possible command bytes of "A" (ASCII 41 hex) and "B" (ASCII 42 
hex), then jumps to the appropriate set up routine for the command 
message. If the input byte does not match either of these values, a 
branch to a set up routine for an error message is executed. 

Cmd_A, Cmd_B, Cmd_l 

These routines set up the proper parameters for writing the output 
message: the number of bytes in the message is moved to the R3L 
register and the base address of the message in the data area is moved 
to address register ER4. 

Write_Msg 

First the base address of the output area is copied to ER5. Then the 
Clear_01d routine writes nulls to 32 bytes of the output area (this 
serves both to initialize the area and to clear old messages written 
during previous program passes). 
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Finally, the proper message is written to the output area by the 
Write_Loop routine. When done, Write_Loop jumps back to Clear and 
the command monitoring process begins again. 

Using the various features of the emulator, we will show you how to 
load this program into emulation memory, execute it, monitor the 
program' s operation with the analyzer, and simulate entry of different 
commands utilizing the memory access commands provided by the HP 
64700 command set. 



2-4 Getting Started 



5448495320495320 
4D45535341474520 
41 

5448495320495320 
4D45535341474520 
42 

494E56414C494420 
434F4D4D414E44 



002000 
002000 
002000 
002008 
002010 
002011 
002019 
002021 
002022 
00202A 
002031 

001000 



001000 7A07000FF904 
001006 7A0100FFF000 



00100C F800 

00100E 6AA800FFF000 



001014 6A2A00FFF000 
00101A AAOO 
00101C 47F6 



00101E AA41 
001020 5870000A 
001024 AA42 
001026 58700010 
00102A 58000018 



00102E FB11 

001030 7A0400002000 

001036 58000014 



00103A FB11 

00103C 7A0400002011 

001042 58000008 



6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 



. SECTION 
. SDATA 

. SDATA 

. SDATA 



Msgs 
Msg_A 



Msg_B 

Msg_I 
End_Msgs 



. SECTION Prog, CODE, LOCATE=H' 1000 

**************************************************** 

* Set up the Pointers. 

**************************************************** 



Table, DATA, LOCATE=H' 2000 
"THIS IS MESSAGE A" 

"THIS IS MESSAGE B" 

"INVALID COMMAND" 



Init 



tStack, ER7 
#Cmd_Input, ER1 



MOV. L 
MOV. L 

t************************************** 



* Clear previous command. 
******************************* 



********************* 
#H' 00, R0L 
R0L, @Cmd_Input 



Clear MOV.B 
MOV.B 

**************************************************** 

* Read command input byte. If no command has been 

* entered, continue to scan for it. 

**************************************************** 
Scan MOV.B @Cmd_Input, R2L 

CMP.B #H'00,R2L 
BEQ Scan 
**************************************************** 

* A command has been entered. Check if it is 

* command A, command B, or invalid command. 
**************************************************** 



Exe_Cmd 



CMP .B 
BEQ 
CMP .B 
BEQ 
BRA 



#H' 41, R2L 

Cmd_A 

#H' 42, R2L 

Cmd_B 

Cmd_I 



* Command A is entered. R3L = the number of bytes 

* in message A. R4 = location of the message. 

* Jump to the routine which writes the message. 
**************************************************** 

Cmd_A MOV.B #Msg_B-Msg_A, R3L 

MOV. L 
BRA 

.**************************************************** 
;* Command B is entered. 

.**************************************************** 



#Msg_A, ER4 
Wr ite_Msg 



Cmd_B 



MOV.B 
MOV. L 
BRA 



#Msg_I-Msg_B, R3L 
#Msg_B, ER4 
Wr ite_Msg 



Figure 2-1. Sample Program Listing 
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49 






50 






51 


001046 


FBOF 


52 


001048 


7A0400002022 


53 






54 






55 






56 


00104E 


7A0500FFF004 


57 


001054 


FE20 


58 


001056 


68D8 


59 


001058 


0B05 


60 


00105A 


1A0E 


61 


00105C 


46F8 


62 






63 






64 






65 


00105E 


7A0500FFF004 


66 


001064 


6C4E 


67 


001066 


68DE 


68 


001068 


0B05 


69 


00106A 


1A0B 


70 


00106C 


46F6 


71 






72 






73 






74 


00106E 


409C 


75 






76 


FFF000 




77 






78 






79 






80 


FFFOOO 


00000004 


81 






82 






83 






84 


FFF004 


00000100 


85 


FFF104 




86 




00001000 


87 



. **************************************************** 
;* An invalid command is entered. 

.**************************************************** 



Cmd_I 



MOV.B 
MOV. L 



#End_Msgs-Msg_I , R3L 
#Msg_I , ER4 
********************** 



* The destination area is cleared. 
********************************** 



t ***** * 



Write_Msg MOV.L 
Clear_01d MOV.B 
Clear_Loop MOV.B 

ADDS . L 

DEC . B 

BNE 

*************************************************** 



#Msg_Dest, ER5 
#H' 20, R6L 
R0L, @ER5 
#1, ER5 

R6L 

Clear_Loop 



* Message is written to the destination. 
**************************************** 



Write_Loop 



#Msg_Dest, ER5 
0ER4+, R6L 
R6L, @ER5 
#1, ER5 

R3L 



********* 

MOV. L 
MOV.B 
MOV.B 
ADDS . L 
DEC . B 

BNE Write_Loop 
.**************************************************** 

;* Go back and scan for next command. 

.**************************************************** 
BRA Clear 

. SECTION Data, DATA, LOCATE=H' FF800 

.**************************************************** 

;* Command input area. 

. **************************************************** 
Cmd_Input .RES.L 1 

. **************************************************** 

;* Destination of the command messages. 
.**************************************************** 



Msg_Dest 
Stack 



. RES.W 
.END 



H' 80 

Init 



Figure 2-1. Sample Program Listing (Cont'd) 



2-6 Getting Started 



Using the Help 
Facility 



If you need a quick reference to the Terminal Interface syntax, you can 
use the built-in help facilities. For example, to display the top level help 
menu, type: 



R> help 



help - display help information 

help <group> - print help for desired group 

help -s <group> - print short help for desired group 

help <command> - print help for desired command 

help - print this help screen 

VALID <group> NAMES 

gram - system grammar 

proc - processor specific grammar 

sys - system commands 

emul - emulation commands 

hi - highlevel commands (hp internal use only) 

trc - analyzer trace commands 

* - all command groups 



You can type the ? symbol instead of typing help. For example, if you 
want a list of commands in the emul command group, type: 

R> ? emul 



emul - emulation commands 



b 


. .break to monitor 


cp. . . 


. copy memory 




. .modes 


be 


. .break condition 


dump . 


.dump memory 


r . . . . 


. . run user code 


bp. . . 


. . breakpoints 


es . . . 


.emulation status 


reg . . 


. . registers 


cf 


. . configuration 


io . . . 


. input / output 


rst . . 


. .reset 


cim. . 


..copy target image 


load. 


. load memory 




. . run at CMB execute 


cmb . . 


..CMB interaction 


m. . . . 


. memory 


s . . . . 


. . step 


cov . . 


. . coverage 


map . . 


.memory mapper 


ser . . 


..search memory 



To display help information for any command, just type help (or ?) and 
the command name. For example: 

R> help load 
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load - download absolute file into processor memory space 



load 


-i 


- download intel hex format 


load 


-m 


- download motorola S-record format 


load 


-t 


- download extended tek hex format 


load 


-s 


- download symbol file 


load 


-n 


- reserved for internal hp use 


load 


-h 


- download hp format (requires transfer protocol) 


load 


-a 


- reserved for internal hp use 


load 


-e 


- write only to emulation memory 


load 


-u 


- write only to target memory 


load 


-b 


- data sent in binary (valid with -h option) 


load 


-x 


- data sent in hex ascii (valid with -h option) 


load 


-q 


- quiet mode 


load 


-p 


- record ACK/NAK protocol (valid with -imt options) 



Initialize the To initialize the emulator to a known state for this tutorial: 

Emulator to a 
Known State 



Note M&M It is especially important that you perform the following step if the 

ST emulator is being operated in a standalone mode controlled by only a 

data terminal. The only program entry available in this mode is 
through memory modification; consequently, if the emulator is 
reinitialized, emulation memory will be cleared and a great deal of 
tedious work could be lost. 



1. Verify that no one else is using the emulator or will have need 
of configuration items programmed into the emulator. 

2. Initialize the emulator by typing the command: 
R> init 
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Set Up the Proper 

Emulation 

Configuration 

Set Up Emulation To set the emulator's configuration values to the proper state for this 
Conditions tutorial, do this: 

1. Type: 



cf chip=2653 

cf clk=int 

cf mode=7 

cf nmi=en 

cf qbrk=dis 

cf rrt=dis 

cf rsp=0f f f f f cOO 

cf trfsh=en 



R> cf 



You should see the following configuration items displayed: 



Note 




The individual configuration items won't be explained in this example; 
refer to Chapter 4 of this manual and the User's Reference manual for 
details. 



2. 



If the configuration items displayed on your screen don't 
match the ones listed above, here is how to make them agree: 



R> 



For each configuration item that does not match, type: 
cf <conf ig_item>=<value> 
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For example, if you have the following configuration items 
displayed (those in bold indicate items different from the list 
above): 

cf chip=2653 
cf clk=ext 

cf mode=7 
cf nmi=en 
cf qbrk=dis 
cf rrt=en 

cf rsp=0f f f f f cOO 
cf trfsh=en 

To make these configuration values agree with the desired 
values, type: 

R> cf clk=int 
R> cf rrt=dis 



be 
be 
be 
be 
be 
be 



-d bp tdisable 
-e rom tenable 
-d bnct tdisable 
-d cmbt tdisable 
-d trigl tdisable 
-d trig2 tdisable 



be 
be 
be 
be 
be 
be 



-d bp tdisable 
-d rom tdisable 
-d bnct tdisable 
-d cmbt tdisable 
-e trigl #enable 
-e trig2 #enable 



3. Let's go ahead and set up the proper break conditions. 
Type: 
R> be 

You will see: 



For each break condition that does not match the one listed, 
use one of the following commands: 

To enable break conditions that are currently disabled, type: 
R> be -e <breakpoint type> 

To disable break conditions that are currently enabled, type: 
R> be -d <breakpoint type> 

For example, if typing be gives the following list of break 
conditions: 



(items in bold indicate improper values for this example) 
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Type the following commands to set the break conditions 

correctly for this example: 
R> be -e rom 

(this enables the write to ROM break) 
R> be -d trigl trig2 

(this disables break on triggers from the analyzer) 



Mapping Memory Depending on the memory board, emulation memory consists of 256K, 

1M or 4M bytes, mappable in IK byte blocks. The monitor occupies 
some memories for internal RAM and monitor program, leaving 248K, 
992K, 3968K bytes of emulation memory which you may use. 



The memory mapper allows you to characterize memory locations. It 
allows you specify whether a certain range of memory is present in the 
target system or whether you will be using emulation memory for that 
address range. You can also specify whether the target system memory 
is ROM or RAM, and you can specify that emulation memory be 
treated as RAM or ROM. 



Type: 

R> map C.Offff erom 

To verify that memory blocks are mapped properly, type: 
R> map 



You will see: 

# remaining number of terms : 15 

# remaining emulation memory : 6e800h bytes 
map 0000000 .. OOOffff erom # term 1 
map other tram 
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Note You must map internal ROM as emulation memory. 



Note 



4 



You don't have to map internal RAM, since the emulator maps internal 
RAM as emulation RAM. And the emulator memory system dose not 
introduce it in memory mapping display. 



Transfer Code 
into Emulation 
Memory 

Transferring Code 
from a Terminal In 
Standalone 
Configuration 



Refer to "Memory Mapping" section of "Configuring the Emulator" 
chapter in this manual for more details. 



To transfer code into emulation memory from a data terminal running 
in standalone mode, you must use the modify memory commands. 
This is necessary because you have no host computer transfer facilities 
to automatically download the code for you (as if you would if you 
were using the transparent configuration or the remote configuration.) 
To minimize the effects of typing errors, you will modify only one row 
of memory at a time in this example. Do the following: 

1. Enter the data information for the program by typing the 
following commands: 



R> m 002000. . 00200f =54 , 48 , 49, 53 , 20 , 49, 53 , 20 , 4d, 45 , 53 , 53 , 41 , 47 , 45, 20 
R> m 002010. .00201f=41,54,48,49,53,20,49,53,20,4d,45,53,53,41,47,45 
R> m 002020. . 00202f =20 , 42 , 49, 4e, 56 , 41 , 4c, 49, 44 , 20 , 43 , 4f , 4d, 4d, 41 , 4e 
R> m 002030=44 



You could also type the following line instead: 

R> m 002000="THIS IS MESSAGE ATHIS IS MESSAGE BINVALID COMMAND" 



2-12 Getting Started 



2. 

R> 



You should now verify that the data area of the program is 

correct by typing: 

m 002000. .002030 



You should see: 

002000 .. 00200f 54 48 49 53 20 49 53 20 4d 45 53 53 41 47 45 20 
002010 .. 00201f 41 54 48 49 53 20 49 53 20 4d 45 53 53 41 47 45 
002020 .. 00202f 20 42 49 4e 56 41 4c 49 44 20 43 4f 4d 4d 41 4e 
002030. .002030 44 



If this is not correct, you can correct the errors by re-entering 
only the modify memory commands for the particular rows of 
memory that are wrong. 

For example, if row 002000..00200f shows these values: 

002000 .. 00200f 54 48 49 53 20 20 49 53 20 4d 45 53 53 41 47 45 

you can correct this row of memory by typing: 

R> m 002000. . 00200f=54, 48, 49, 53, 20, 49, 53, 20, 4d, 45, 53, 53, 41, 47, 45, 20 

Or, you might need to modify only one location, as in the 
instance where address 00200f equals 22 hex rather than 20 
hex. Type: 
R> m 00200f=22 



3. Enter the program information by typing the following 
commands: 

(Note the hex letters must be preceded by a digit.) 

R> m 001000. .00100f=7a,07,00,0ff,0fl,04,7a,01,00,0ff, Of 0 , 00 , Of 8 , 00 , 6a, 0a8 

R> m 001010 . . 00101f=00, Off , Of 0, 00, 6a, 2a, 00, Off , Of, 00, Oaa, 00, 47, Of 6, Oaa, 41 

R> m 001020. . 00102f=58, 70, 00, 0a, Oaa, 42 , 58 , 70 , 00 , 10 , 58 , 00 , 00 , 18 , Ofb, 11 

R> m 001030. .00103f=7a, 04 , 00 , 00 , 20 , 00 , 58 , 00 , 00 , 14 , Ofb, 11, 7a, 04, 00, 00 

R> m 001040. .00104f=20, 11, 58, 00, 00, 08, Ofb, Of, 7a, 04, 00, 00, 20, 22, 7a, 05 

R> m 001050 . . 00105f=00, Off , Of 0 , 04 , Of e, 20 , 68 , 0d8 , 0b, 05, la, Oe, 46, Of 8, 7a, 05 

R> m 001060. .00106f=00,0ff,0f,04,6c,4e,68,0de,0b,05,la,0b,46,0f6,40,9c 



4. You should now verify that the program area is correct by 
typing: 

R> m 001000. .00106f 



You should see: 
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001000 . . OOlOOf 
001010 . . OOlOlf 
001020 . . 00102f 
001030 . . 00103f 
001040 . . 00104f 
001050 . . 00105f 
001060. .00106f 



7a 07 00 Of f9 

54 48 49 53 20 

41 54 48 49 53 

7a 04 00 00 20 

20 11 58 00 00 

00 ff fO 04 fe 

00 ff fO 04 6c 



04 7a 01 00 Of 
49 53 20 4d 45 
20 49 53 20 4d 
00 58 00 00 14 
08 fb Of 7a 04 
20 68 c!8 Ob 05 
4e 68 de Ob 05 



f8 00 f8 00 6a a8 

53 53 41 47 45 20 

45 53 53 41 47 45 

fb 11 7a 04 00 00 

00 00 20 22 7a 05 

la Oe 46 f8 7a 05 

la Ob 46 f6 40 9c 



If this is not correct, you can correct the errors by re-entering 
only the modify memory commands for the particular rows of 
memory that are wrong. 
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Looking at Your 
Code 



Now that you have loaded your code into emulation memory, you can 
display it in mnemonic format. Type: 



R> m -dm 1000 . . 106f 

You will see: 



0001000 
0001006 
000100c 
OOOlOOe 
0001014 
000101a 
000101c 
OOOlOle 
0001020 
0001024 
0001026 
000102a 
000102e 
0001030 
0001036 
000103a 
000103c 
0001042 
0001046 
0001048 
000104e 
0001054 
0001056 
0001058 
000105a 
000105c 
000105e 
0001064 
0001066 
0001068 
000106a 
000106c 
000106e 



MOV.L #00fff 104, ER7 
MOV.L #00f f f 000, ER1 
MOV.B #00,R0L 
MOV.B R0L, @0fff000 
MOV.B @fff000,R2L 
CMP.B #00,R2L 
BEQ 001014 
CMP.B #41,R2L 
BEQ 00102e 
CMP.B #42,R2L 
BEQ 00103a 
BRA 00104 6 
MOV.B #11,R3L 
MOV.L #00002000, ER4 
BRA 00104e 
MOV.B #11,R3L 
MOV.L #00002011, ER4 
BRA 00104e 
MOV.B #0f,R3L 
MOV.L #00002022, ER4 
MOV.L #00fff004,ER5 
MOV.B #2 0,R6L 
MOV.B R0L, @ER5 
ADDS #1,ER5 
DEC . B R6L 
BNE 00105 6 
MOV.L #00fff004,ER5 
MOV.B @ER4+,R6L 
MOV.B R6L, @ER5 
ADDS #1,ER5 
DEC . B R3L 
BNE 001064 
BRA 00100c 
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Familiarize 
Yourself with the 
System Prompts 



Note 




The following steps are not intended to be complete explanations of 
each command; the information is only provided to give you some idea 



of the meanings of the various command prompts you may see and 
reasons why the prompt changes as you execute various commands. 



You should gain some familiarity with the HP 64700 emulator 
command prompts by doing the following: 

1. Ignore the current command prompt. Type: 
*> rst 

You will see: 

R> 

The rst command resets the emulation processor and holds it 
in the reset state. The "R>" prompt indicates that the 
processor is reset. 

2. Type: 
R> r 1000 

You will see: 

U> 

The r command runs the processor from address 1000 hex. 

3. Type: 
U> b 

You will see: 

M> 

The b command causes the emulation processor to "break" 
execution of whatever it was doing and begin executing within 
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the emulation monitor. The "M>" prompt indicates that the 
emulator is running in the monitor. 



Note 




If DMA transfer is in progress with BURST transfer mode, b command 
is suspended and occurs after DMA transfer is completed. 



Running the 

Sample Program 4 Type: 



M> r 1000 

The emulator changes state from background to foreground 
and begins running the sample program from location 1000 
hex. 



Not© ItSa The default number base for address and data values within HP 64700 

is hexadecimal. Other number bases may be specified. Refer to the 
Tutorials chapter of this manual or the HP 64700 User's Reference 
manual for further details. 



5. Let's look at the registers to verify that the address registers 
were properly initialized with the pointers to the input and 
output areas. Type: 
U> reg 

You will see: 



reg pc=00101a ccr=84 exr=7f er0=00000000 erl=00fff000 er2=00000000 

reg er3=00000000 er4=00000000 er5=00000000 er6=00000000 er7=00fffl04 reg sp=00fffl04 
mach=00000000 macl=00000000 mdcr=87 



Notice that ER1 contains OfffOOO hex. 
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6. Verify that the input area command byte was cleared during 
initialization. 



Type: 



U> m -db OfffOOO 



You will see: 



OfffOOO . . OfffOOO 



00 



The input byte location was successfully cleared. 

7. Now we will use the emulator features to make the program 
work. Remember that the program writes specific messages to 
the output area depending on what the input byte location 
contains. Type: 
U> m 0fff000=41 

This modifies the input byte location to the hex value for an 
ASCII "A". Now let's check the output area for a message. 
U> m 0fff004. .0fff023 
You will see: 



These are the ASCII values for Msg_A. 

Repeat the last two commands twice. The first time, use 42 
instead of 41 at location ff800h and note that Msg_B 
overwrites Msg_A. Then try these again, using any number 
except 00, 41, or 42 and note that the Msg_I message is 
written to this area. 



Of f f 004 . . Of f f 013 
Of f f 014 . . Of f f 023 



54 48 49 53 20 
41 00 00 00 00 



49 53 20 4d 45 53 53 41 47 45 20 
00 00 00 00 00 00 00 00 00 00 00 
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Stepping Through 

8. You can also direct the emulator processor to execute one 
instruction or number of instructions. Type: 

M> s 1 1000; reg 

This command steps 1 instruction from address 1000 hex, and 
displays registers. You will see: 

0001000 - MOV.L #00fff 104, ER7 

PC =0001006 

reg pc=001006 ccr=80 exr=7f er0=00000000 erl=00fff000 er2=00000000 
reg er3=00000000 er4=00002011 er5=00fff015 er6=00000041 er7=00fffl04 
reg sp=00fffl04 mach=00000000 macl=00000000 mdcr=87 

Notice that PC contains 1006 hex. 

9. To step one instruction from present PC, you only need to type 
s at prompt. Type: 

M> s ; reg 

You will see: 

0001006 - MOV.L #00fff000,ERl 

PC =000100c 

reg pc=00100c ccr=80 exr=7f er0=00000000 erl=00fff000 er2=00000000 
reg er3=00000000 er4=00002011 er5=00fff015 er6=00000041 er7=00fffl04 
reg sp=00fffl04 mach=00000000 macl=00000000 mdcr=87 



the Program 



Tracing Program 
Execution 

Predef i ned Trace Three trace labels are predefined in the H8S/2000 emulator. You can 
Labels y i ew these labels by entering the db (trace label) command with no 
options. 

M> tlb 

#### Emulation trace labels 
tlb addr 16. .39 
tlb data 0 . . 15 
tlb stat 40 . . 63 
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Common values for the H8S/2000 status trace signals have been 
predefined. You can view these predefined equates by entering the equ 
command with no options. 

M> equ 

### Equates ### 

equ bg=OxxxOxxxxxxxxxxxxxxxxxxxxy 
equ byte=Oxxxxxxxxxxxxxlxxxxxxxxlxy 
equ cpu^OxxxxxxxxxxxxxlxxllOxxxxxy 
equ data=OxxxxxxxxxxxxxlxlllOxxxxxy 
equ dma=OxxxxxxxxxxxxxlxO 0 0 Oxxxxxy 
equ dt c-OxxxxxxxxxxxxxlxO 0 0 lxxxxxy 
equ f etch=0xxxxxxxxxxxxxlx0110xxx01y 
equ f g=Oxxxlxxxxxxxxxxxxxxxxxxxxy 
equ grd=0xxxx01xxxxxxxlxxxxxxxxxxy 
equ intack=OxxxxxxxOxxOxxxxxxxxxxxxxy 
equ io=0xxxxxxxxxxxxxlxxxxx01xxxy 
equ read=Oxxxxxxxxxxxxxlxxxxxxxxxly 
equ word=OxxxxxxxxxxxxxlxxxxxxxxOxy 
equ wr ite=OxxxxxxxxxxxxxlxxxxxxxxxOy 
equ wr rom=OxxxxlOxxxxxxxlxxxxxxxxxOy 



Predefined Status 
Equates 



These equates may be used to specify values for the stat trace label 
when qualifying trace conditions. 



Specifying a Trigger Now let's use the emulation analyzer to trace execution of the program. 

Suppose that you would like to start the trace when the analyzer begins 
writing data to the message output area. You can do this by specifying 
analyzer trigger upon encountering the address 0fff004 hex. 
Furthermore, you might want to store only the data written to the 
output area. This can be accomplished by modifying what is known as 
the "analyzer storage specification". 



4 



Note HSm For this example, you will be using the analyzer in the easy 

configuration, which simplifies the process of analyzer measurement 
setup. The complex configuration allows more powerful measurements, 
but requires more interaction from you to set up those measurements. 
For more information on easy and complex analyzer configurations and 
the analyzer, refer to the//f 64700 Analyzer User's Guide and the 
User's Reference. 
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Now, let's set the trigger specification. Type: 
M> tg addr=0fff004 

To store only the accesses to the address range 0fff04 through 0fff015 
hex, type: 

M> tsto addr=0fff004. .0fff015 

Let' s change the data format of the trace display so that you will see the 
output message writes displayed in ASCII format: 

M> tf addr,h data, A count, R seq 

Start the trace by typing: 
M> t 

You will see: 

Emulation trace started 

To start the emulation run, type: 
M> r 1000 

Now, you need to have a "command" input to the program so that the 
program will jump to the output routines (otherwise the trigger will not 
be found, since the program will never access address 0fff004 hex). 
Type: 

U> m 0fff000=41 

To display the trace list, type: 
U> tl 0. .34 

You will see: 
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Line addr,H data, A count, R seq 



0 f f f 004 . . 

1 f f f 005 . . 

2 fff006 . . 

3 f f f 007 . . 

4 fff008 . . 

5 f f f 009 . . 

6 f f f 00a . . 

7 f f f 00b . . 

8 f f f 00c . . 

9 f f f OOd . . 

10 f f f OOe . . 

11 fffOOf . . 

12 fffOlO . . 

13 fffOll . . 

14 fff012 . . 

15 fff013 . . 

16 fff014 . . 

17 fff015 . . 

18 fff004 T. 

19 fff005 .H 

20 fff006 I. 

21 fff007 .S 

22 f f f 008 . . 

23 fff009 .1 

24 fffOOa S. 

25 f f f 00b . . 

26 fffOOc M. 

27 fffOOd . E 

28 fffOOe S. 

29 fffOOf .S 

30 fffOlO A. 

31 fffOll .G 

32 fff012 E. 

33 f f f 013 . . 

34 fff014 A. 



0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
0 . 60uS 
9. 60uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
0 . 90uS 
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Using Software 
Breakpoints 



You can stop program execution at specific address by using bp 
(software breakpoint) command. When you define a software 
breakpoint to a certain address, the emulator will replace the opcode 
with one of undefined opcode (5770 hex) as software breakpoint 
instruction. When the emulator detects the special instruction, user 
program breaks to the monitor, and the original opcode will be placed 
at the breakpoint address. A subsequent run or step command will 
execute from this address. 

If the special instruction was not inserted as the result of bp command 
(in other words, it is part of the user program), the "Undefined software 
breakpoint" message is displayed. 



4 



Note mcI You can set software breakpoints only at memory locations which 
contain instruction opcodes (not operands or data). If a software 
breakpoint is set at a memory location which is not an instruction 
opcode, the software breakpoint instruction will never be executed and 
the break will never occur. 



Note MSa Because software breakpoints are implemented by replacing opcodes 
with the software breakpoint instruction, you cannot define software 
breakpoints in target ROM. You can, however, copy target ROM into 
emulation memory by cim command. (Refer to HP 64700 Terminal 
Interface User's Reference manual.) 



Before you can define software breakpoints, you must enable software 
breakpoints with the be (break conditions) command. To view the 
default break conditions and change the software breakpoint condition, 
enter the following commands. 

M> be 

be -d bp #disable 
be -e rom tenable 
be -d bnct #disable 
be -d cmbt #disable 



Displaying and 
Modifying the Break 
Conditions 
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be 
be 



-d trigl #disable 
-d trig2 tdisable 



M> be -e bp 



Defining a Software 
Breakpoint 



Now that the software breakpoint is enabled, you can define software 
breakpoints. Enter the following command to break on the address of 
the Write_Msg label. 

M> bp 104e 



Run the program and verify that execution broke at the appropriate 
address. 

M> r 1000 

U> m 0fff000=41 

!ASYNC_STAT 615! Software break point: 000104e 

M> reg 

reg pc=00104e ccr=80 exr=7f er0=00000000 erl=00fff000 er2=00000041 
reg er3=00000011 er4=00002000 er5=00fff015 er6=00000041 er7=00fffl04 
reg sp=00fffl04 mach=00000000 macl=00000000 mdcr=87 

Notice that PC contains 104e. 

When a breakpoint is hit, it becomes disabled. You can use the -e 
option to the bp command to re-enable the software breakpoint. 

M> bp 

###BREAKPOINT FEATURE IS ENABLED### 
bp 000104e #disabled 

M> bp -e 104e 

M> bp 

###BREAKPOINT FEATURE IS ENABLED### 
bp 000104e #enabled 

M> r 1000 

U> m 0fff000=41 

! ASYNC_STAT 615! Software breakpoint: 000104e 

M> bp 

###BREAKPOINT FEATURE IS ENABLED### 
bp 000104e tdisabled 
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Searching 
Memory for 
Strings or 
Numeric 
Expressions 



The HP 64700 Emulator provides you with tools that allow you to 
search memory for data strings or numeric expressions. For example, 
you might want to know exactly where a string is loaded. To locate the 
position of the string "THIS IS MESSAGE A" in the sample program. 
Type: 



M> ser 2000. .2fff="THIS IS MESSAGE A" 



pattern match at address: 



0002000 



You can also find numeric expressions. For example, you might want 
to find all of the CMP.B instructions in the sample program. Since a 
CMP.B instruction begins with aa hex, you can search for that value by 
typing: 

M> ser -db 10000 .. 106f=0aa 



pattern match at address: 000101a 
pattern match at address: OOOlOle 
pattern match at address: 0001024 



Trace Analysis 
Considerations 



There are some points you need to attend to in using the emulation 
analyzer. The following section describes such points. 



How to Specify the 
Trigger Condition 



Suppose that you would like to start the trace when the program begins 
executing Exe_Cmd routine. 



To initialize the emulation analyzer, type: 
U> tinit 



Getting Started 2-25 



To set the trigger condition, type: 
U> tg addr=101e 

Start the trace and modify memory so that the program will jump to the 
Exe_Cmd routine: 

U> t 

U> m 0fff000=41 

To display the trace list, type: 
U> tl 0. .20 



Line addr,H H8S/2653 mnemonic, H count, R seq 



0 OOlOle aa41 fetch mem + 

1 001014 MOV.B @fff000,R2L O.lOuS 

2 001016 OOff fetch mem O.lOuS 

3 001018 fOOO fetch mem O.lOuS 

4 00101a CMP.B #00,R2L 0.08uS 

5 fffOOO OOxx read mem byte 0.12uS 

6 00101c BEQ 001014 O.lOuS 

7 OOlOle aa41 fetch mem O.lOuS 

8 001014 MOV.B @fff000,R2L O.lOuS 

9 001016 OOff fetch mem 0.08uS 

10 001018 fOOO fetch mem 0.12uS 

11 00101a CMP.B #00,R2L O.lOuS 

12 fffOOO OOxx read mem byte O.lOuS 

13 00101c BEQ 001014 O.lOuS 

14 OOlOle aa41 fetch mem 0.08uS 

15 001014 MOV.B @fff000,R2L 0.12uS 

16 001016 OOff fetch mem O.lOuS 

17 001018 fOOO fetch mem O.lOuS 

18 00101a CMP.B #00,R2L O.lOuS 

19 fffOOO OOxx read mem byte O.lOuS 

20 00101c BEQ 001014 0.08uS 



This is not what we were expecting to see. (We expected to see the 
program executed Exe_Cmd routine which starts from lOle hex.) As 
you can see at the fist line of the trace list, address lOle hex appears on 
the address bus during the program executing Scan loop. This triggered 
the emulation analyzer before EXE_Cmd routine was executed. To 
avoid mis-trigger by this cause, set the trigger condition to the second 
instruction of the routine you want to trace. Type: 

U> tg addr=1020 

To change the trigger position so that 10 states appear before the trigger 
in the trace list, type: 

U> tp -b 10 

Start the trace again and modify memory: 
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u> t 

U> m 0fff000=41 

Now display the trace list: 
U> tl -10. .10 

As you can see, the analyzer captured the execution of Exe_Cmd 



Line addr,H H8S/2653 mnemonic, H count, R seq 



-10 


00101c 


BEQ 001014 






-9 


OOlOle 


aa41 fetch mem 


0 


lOuS 


-8 


001014 


MOV.B @fffOOO,R2L 


0 


lOuS 


-7 


001016 


OOff fetch mem 


0 


lOuS 


-6 


001018 


fOOO fetch mem 


0 


lOuS 


-5 


00101a 


CMP.B #00,R2L 


0 


lOuS 


-4 


fffOOO 


41xx read mem byte 


0 


lOuS 


-3 


00101c 


BEQ 001014 


0 


lOuS 


-2 


OOlOle 


CMP.B #41,R2L 


0 


lOuS 


-1 


001014 


6a2a unused fetch mem 


0 


12uS 


0 


001020 


BEQ 00102e 


0 


08uS 


1 


001022 


000a fetch mem 


0 


lOuS 


2 


00102e 


MOV.B #11,R3L 


0 


20uS 


3 


001030 


MOV.L #00002000, ER4 


0 


12uS 


4 


001032 


0000 fetch mem 


0 


08uS 


5 


001034 


2000 fetch mem 


0 


lOuS 


6 


001036 


BRA 00104e 


0 


lOuS 


7 


001038 


0014 fetch mem 


0 


lOuS 


8 


00104e 


MOV.L #00fff004,ER5 


0 


20uS 


9 


001050 


OOff fetch mem 


0 


lOuS 


10 


001052 


f004 fetch mem 


0 


lOuS 



routine which starts from line -2 of the trace list. 

When you specify store condition with tsto command, disassembling of 
program execution may not be accurate. 

Type: 

U> tinit 

U> t 

U> tl 0. .20 



Store Condition and 
Disassembling 
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Line addr,H H8S/2653 mnemonic, H count, R seq 



0 


001016 


OOff fetch mem 








1 


001018 


fOOO fetch mem 




0 


12uS 


2 


00101a 


CMP.B #00,R2L 




0 


lOuS 


3 


fffOOO 


OOxx read mem 


byte 


0 


lOuS 


4 


00101c 


BEQ 001014 




0 


08uS 


5 


OOlOle 


aa41 fetch mem 




0 


lOuS 


6 


001014 


MOV.B @fff000,R2L 




0 


12uS 


7 


001016 


OOff fetch mem 




0 


lOuS 


8 


001018 


fOOO fetch mem 




0 


lOuS 


9 


00101a 


CMP.B #00,R2L 




0 


lOuS 


10 


fffOOO 


OOxx read mem 


byte 


0 


08uS 


11 


00101c 


BEQ 001014 




0 


lOuS 


12 


OOlOle 


aa41 fetch mem 




0 


12uS 


13 


001014 


MOV.B @fff000,R2L 




0 


lOuS 


14 


001016 


OOff fetch mem 




0 


lOuS 


15 


001018 


fOOO fetch mem 




0 


08uS 


16 


00101a 


CMP.B #00,R2L 




0 


lOuS 


17 


fffOOO 


OOxx read mem 


byte 


0 


12uS 


18 


00101c 


BEQ 001014 




0 


lOuS 


19 


OOlOle 


aa41 fetch mem 




0 


lOuS 


20 


001014 


MOV.B @fff000,R2L 




0 


08uS 



The program is executing Scan loop. 



Now, specify the store condition so that only accesses to the address 
range 1000 hex through lOff hex will be stored: 

U> tsto addr=1000. .10ff 

Start the trace and display the trace list: 
U> t 

U> tl 0. .20 

Line addr,H H8S/2653 mnemonic, H count, R seq 



0 


001016 


OOff fetch mem 






1 


001018 


fOOO fetch mem 


0 


12uS 


2 


00101a 


aaOO fetch mem 


0 


lOuS 


3 


00101c 


BEQ 001014 


0 


20uS 


4 


OOlOle 


aa41 fetch mem 


0 


08uS 


5 


001014 


MOV.B @fff000,R2L 


0 


lOuS 


6 


001016 


OOff fetch mem 


0 


12uS 


7 


001018 


fOOO fetch mem 


0 


lOuS 


8 


00101a 


aaOO fetch mem 


0 


lOuS 


9 


00101c 


BEQ 001014 


0 


18uS 


10 


OOlOle 


aa41 fetch mem 


0 


12uS 


11 


001014 


MOV.B @fff000,R2L 


0 


lOuS 


12 


001016 


OOff fetch mem 


0 


lOuS 


13 


001018 


fOOO fetch mem 


0 


08uS 


14 


00101a 


aaOO fetch mem 


0 


lOuS 


15 


00101c 


BEQ 001014 


0 


22uS 


16 


OOlOle 


aa41 fetch mem 


0 


lOuS 


17 


001014 


MOV.B @fff000,R2L 


0 


lOuS 


18 


001016 


OOff fetch mem 


0 


08uS 


19 


001018 


fOOO fetch mem 


0 


lOuS 


20 


00101a 


aaOO fetch mem 


0 


12uS 
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As you can see, the executions of CMP.B instruction are not 
disassembled. This occurs when the analyzer cannot get necessary 
information for disassembling because of the store condition. Be 
careful when you use the store condition. 

Triggering the You may want to trigger the emulation analyzer when specific data 
Analyzer by Data appears on the data bus. You can accomplish this with the following 

command. 

U> tg data=<data> 

There are some points to be noticed when you trigger the analyzer in 
this way. You always need to specify the <data> with 16 bits value 
even when access to the data is performed by byte access. This is 
because the analyzer is designed so that it can capture data on internal 
data bus (which has 16 bits width). The following table shows the way 
to specify the trigger condition by data. 



Location of 
data 



Access I Address I Available 
size I value I <data> Specification 



3/16 bit data 
bus area 



even 

byte t +- 

I odd I 



word 



ddxx 
xxdd 



1st 



long | even | 

I 2nd 



hhll 
hhhl 
lhll 



*1 
*1 



*2 
*3 
*3 



*1 dd means 8 bits data 
*2 hhll means 16 bits data 

*3 long word access always stores 32bit as two word accesses 



For example, to trigger the analyzer when the processor performs word 
access to data 1234 hex in 16 bit bus area, you can specify the 
following: 

U> tg data=1234 

To trigger the analyzer when the processor accesses data 12 hex to the 
even address located in 8 bit data bus area: 

U> tg data=12xx 
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On the other hand, to trigger 12 hex to the odd address located 8 bit 
data bus. 

U> tg data=0xxl2 

Notice that you always need to specify "xx" value to capture byte 
access. Be careful to trigger the analyzer by data. 

You're now finished with the "Getting Started" example. You can 
proceed on with using the emulator and use this manual and the 
Terminal Interface Reference manual as needed to answer your 
questions. 
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In-Circuit Emulation 



When you are ready to use the H8S/2000 emulator in conjunction with 
actual target system hardware, there are some special considerations 
you should keep in mind. 

■ installing the emulator probe 

■ properly configure the emulator 

We will cover the first topic in this chapter. For complete details on 
in-circuit emulation configuration, refer to Chapter 4. 
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Installing the 
Target System 
Probe 



Warning 




The following precautions should be taken while using the H8S/2000 
emulator. Damage to the emulator circuitry may result if these 



precautions are not observed. 

Power Down Target System. Turn off power to the user target system 
and to the H8S/2000 emulator before attaching and detaching the PGA 
adapter to the emulator or target system to avoid circuit damage 
resulting from voltage transients or mis-insertion 

Verify User Plug Orientation. Make certain that Pin 1 of the QFP 

socket/adapter and Pin 1 of the QFP cable are properly aligned before 
inserting the QFP cable into the QFP socket/adapter. Failure to do so 
may result in damage to the emulator circuitry. 

Protect Against Static Discharge. The H8S/2000 emulator and the 
PGA adapter contain devices which are susceptible to damage by static 
discharge. Therefore, operators should take precautionary measures 
before handling the user plug to avoid emulator damage. 

Compatibility of VOLTAGE/CURRENCY. Please be sure to check 
that the voltage/currency of the emulator and target system being 
connected are compatible. If there is a discrepancy, damage may result. 

Protect Target System CMOS Components. If your target system 
includes any CMOS components, turn on the target system first, then 
turn on the H8S/2000 emulator; when powering down, turn off the 
emulator first, then turn off power to the target system. 
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The H8S/2000 emulator is provided without any QFP cable. To 
emulate each processor with your target system, you need to purchase 
appropriate QFP cable, separately. 

QFP Cable To emulate each processor with your target system, you can use the 
QFP cable as shown in Figure 3-1. The QFP cable allows you to 
connect the emulation probe to QFP socket/adapter on your target 
system using with the PGA adapter. Refer to the Table 1-1 to know 
appropriate QFP cable. 



Caution 




Do not apply strong force to the QFP cable, as that might damage the 
QFP cable. 



QFP SOCket/adapter To do in-circuit emulation, you must attach the QFP socket/adapter to 

your target system and connect with the PGA adapter through the QFP 
cable. One QFP socket/adapter is provided with the QFP cable. 



Note 




You can order additional QFP socket/adapter with part number listed in 
Table 1-1. 



3-3 In-Circuit Emulation 



Installing the PGA 
adapter 



You can use the PGA adapter to connect the emulator to your target 
system. This PGA adapter gives you a feature to emulate your target 
system running with supply voltage from 2.7V up to 5.25V. 



ml 

Note SI You must also use a clock conforming to the specification of Table 1-2, 

when you do in-circuit emulation and configure the emulator to use 
external clock. 



1. Attach the QFP socket/adapter to your target system. 

2. Connect the PGA adapter to the emulation probe. 

3. Install the QFP cable to the QFP socket/adapter as shown in 
Figure 3-1. 
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Installing the 
H8S/2000 
microprocessor 



You can replace the QFP cable with H8S/2000 microprocessor. Refer 
to the Figure 3-2. 




Note aaei The QFP socket/adapter (E3471-61621) does not have the cap required 

«P for attaching a microprocessor. To attach a microprocessor, you need to 

purchase the cap (P/N E3471-61631), separately. 
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Run from Target 
System Reset 



You can use "r rst" command to execute program from target system 
reset. You will see T> system prompt when you enter "r rst". In this 
status, the emulator accept target system reset. Then program starts if 
reset signal from target system is released. 



Note MsL In the "Awaiting target reset" status(T>), you can not break into the 



1 



monitor. If you enter "r rst" in out-of-circuit or in the configuration that 
emulator does not accept target system reset (cf trst=dis), you must 
reset the emulator. 
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PGA Pin 
Assignments 



When you connect the PGA adapter to your target system directly, pin 
assignment of your target PGA socket must be compatible with the 
PGA adapter pin assignment. The following table and figure show you 
the pin assignment of the PGA adapter. 
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Figure 3-3 PGA adapter pin assignment 
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Table 3-1 PGA177 to QFP120 Pin Assignment (E3471-61610) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
pin 


Function 
name 


1 




nc 


15 




nc 


2 




nc 


16 




nc 


3 


119 


PG3 


17 


29 


P67 


4 




nc 


18 




nc 


5 


2 


PCO 


19 


32 


P64 


6 


5 


PC3 


20 


35 


PE1 


7 


8 


PC5 


21 


38 


Vss 


8 


11 


PBO 


22 


41 


PE6 


9 


14 


PB3 


23 


44 


PD1 


10 


17 


PB5 


24 


47 


Vss 


11 


20 


PAO 


25 


50 


PD6 


12 


23 


PA3 


26 


53 


P30 


13 


26 


PA5 


27 


56 


P33 


14 


28 


PA7 


28 


58 


P35 
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Table 3-1 PGA177 to QFP120 Pin Assignment (E3471-61610)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 m 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
pin# 


Function 
name 


29 




nc 


43 




nc 


30 




nc 


44 




nc 


31 


59 


Vss 


45 


89 


P50 


32 




nc 


46 




nc 


33 


62 


P62 


47 


92 


P53 


34 


65 


P26 


48 


95 


P40 


35 


68 


P23 


49 


98 


P43 


36 


71 


P20 


50 


101 


P46 


37 


74 


NMI 


51 


104 


Vss 


38 


77 


XTAL 


52 


107 


P15 


39 


80 


PF7 


53 


110 


P12 


40 


83 


PF5 


54 


113 


MDO 


41 


86 


PF2 


55 


116 


PG0 


42 


88 


PFO 


56 


118 


PG2 
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Table 3-1 PGA177 to QFP120 Pin Assignment (E3471-61610)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 m 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
pin# 


Function 
name 


57 




nc 


71 




nc 


58 


120 


PG4 


72 


33 


Vcc 


59 




nc 


73 


36 


PE2 


60 


3 


PCI 


74 


39 


PE4 


61 


6 


Vss 


75 


42 


PE7 


62 


9 


PC6 


76 


45 


PD2 


63 


12 


PB1 


77 


48 


PD4 


64 


15 


Vss 


78 


51 


PD7 


65 


18 


PB6 


79 


54 


P31 


66 


21 


PA1 


80 


57 


P34 


67 


24 


Vss 


81 




nc 


68 


27 


PA6 


82 


60 


P60 


69 




nc 


83 




nc 


70 


30 


P66 


84 


63 


P63 
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Table 3-1 E3471-61610 PGA to QFP120 Adaptor Pin Assignment (Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 m 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 

1ZU 

pin# 


Function 
name 


85 


66 


P25 


99 


102 


P47 


86 


69 


P22 


100 


105 


P17 


87 


72 


WDTOVF 


101 


108 


P14 


88 


75 


STBY 


102 


111 


Pll 


89 


78 


EXTAL 


103 


114 


MD1 


90 


81 


Vcc 


104 


117 


PG1 


91 


84 


PF4 


105 




GND 


92 


87 


PF1 


106 


1 


Vcc 


93 




nc 


107 


4 


PC2 


94 


90 


P51 


108 


7 


PC4 


95 




nc 


109 


10 


PC7 


96 


93 


AVcc 


110 


13 


PB2 


97 


96 


P41 


111 


16 


PB4 


98 


99 


P44 


112 


19 


PB7 
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Table 3-1 PGA177 to QFP120 Pin Assignment (E3471-61610)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 m 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 

1ZU 

pin# 


Function 
name 


113 


22 


PA2 


127 


64 


P27 


114 


25 


PA4 


128 


67 


P24 


115 




nc 


129 


70 


P21 


116 


31 


P65 


130 


73 


RES 


117 


34 


PEO 


131 


76 


Vcc 


118 


37 


PE3 


132 


79 


Vss 


119 


40 


PE5 


133 


82 


PF6 


120 


43 


PDO 


134 


85 


PF3 


121 


46 


PD3 


135 




nc 


122 


49 


PD5 


136 


91 


P52 


123 


52 


Vcc 


137 


94 


Vref 


124 


55 


P32 


138 


97 


P42 


125 




GND 


139 


100 


P45 


126 


61 


P61 


140 


103 


AVss 
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Table 3-1 PGA177 to QFP120 Pin Assignment (E3471-61610)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 m 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
pin# 


Function 
name 


141 


106 


P16 


155 




nc 


142 


109 


P13 


156 




nc 


143 


112 


P10 


157 




nc 


144 


115 


MD2 


158 




nc 


145 




GND 


159 




nc 


146 




nc 


160 




nc 


147 




nc 


161 




GND 


148 




nc 


162 




nc 


149 




nc 


163 




nc 


150 




nc 


164 




nc 


151 




nc 


165 




nc 


152 




nc 


166 




nc 


153 




nc 


167 




nc 


154 




nc 


168 




nc 
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Table 3-1 PGA177 to QFP120 Pin Assignment (E3471-61610)(Cont'd) 



PGA 


QFP 


Function 


PGA 


QFP 


Function 


177 


120 


name 


177 


120 


name 


pin# 


pin# 




pin# 


pin# 




169 




nc 


174 




nc 


170 




nc 


175 




nc 


171 




nc 


176 




nc 


172 




nc 


177 




GND 


173 




nc 
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Table 3-2 PGA177 to QFP128 Pin Assignment (E3471-61611) 







Function 






r uncnon 


177 


128 


name 


177 


128 


name 


nin H 

IT 


n in if 
|illl Tr 




■tin it 
JJ in tr 


rtivi 
pin 




l 




np 
11C 


i ^ 




ne 


2 




11C 


1 VJ 




np 

lie 


.J 




pn3 

IT VJJ 


17 


33 


P67 


4 




Vss 

V 


18 


35 


Vss 

V 




ft 

V' 


pro 


19 

i y 


38 

.JO 


P64 


A 
<J 


Q 

y 


r v 




41 

T" 1 


PF1 


7 


12 


PCS 

I v.. 


21 


44 


Vss 

V L>L> 


8 


15 


PBO 


22 


47 


PE6 


9 


18 


PB3 


23 


50 


PD1 


10 


21 


PB5 


24 


53 


Vss 


11 


24 


PAO 


25 


56 


PD6 


12 


27 


PA3 


26 


59 


P30 


13 


30 


PA5 


27 


62 


P33 


14 


32 


PA7 


28 


64 


P35 
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Table 3-2 PGA177 to QFP128 Pin Assignment (E3471-61611)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 

1 ^8 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
pin# 


Function 
name 


29 




nc 


43 




nc 


30 




nc 


44 




nc 


31 


65 


Vss 


45 


97 


P50 


32 


67 


Vss 


46 


99 


Vss 


33 


70 


P62 


47 


102 


P53 


34 


73 


P26 


48 


105 


P40 


35 


76 


P23 


49 


108 


P43 


36 


79 


P20 


50 


111 


P46 


37 


82 


NMI 


51 


114 


Vss 


38 


85 


XTAL 


52 


117 


P15 


39 


88 


PF7 


53 


120 


P12 


40 


91 


PF5 


54 


123 


MD0 


41 


94 


PF2 


55 


126 


PG0 


42 


96 


PFO 


56 


128 


PG2 
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Table 3-2 PGA177 to QFP128 Pin Assignment (E3471-61611)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 ">& 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
pin# 


Function 
name 


57 




nc 


71 


36 


Vss 


58 


2 


PG4 


72 


39 


Vcc 


59 


4 


Vss 


73 


42 


PE2 


60 


7 


PCI 


74 


45 


PE4 


61 


10 


Vss 


75 


48 


PE7 


62 


13 


PC6 


76 


51 


PD2 


63 


16 


PB1 


77 


54 


PD4 


64 


19 


Vss 


78 


57 


PD7 


65 


22 


PB6 


79 


60 


P31 


66 


25 


PA1 


80 


63 


P34 


67 


28 


Vss 


81 




nc 


68 


31 


PA6 


82 


66 


P60 


69 




nc 


83 


68 


Vss 


70 


34 


P66 


84 


71 


P63 
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Table 3-2 PGA177 to QFP128 Pin Assignment (E3471-61611)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 ">& 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
pin# 


Function 
name 


85 


74 


P25 


99 


112 


P47 


86 


77 


P22 


100 


115 


P17 


87 


80 


WDTOVF 


101 


118 


P14 


88 


83 


STBY 


102 


121 


Pll 


89 


86 


EXTAL 


103 


124 


MD1 


90 


89 


Vcc 


104 


127 


PG1 


91 


92 


PF4 


105 




GND 


92 


95 


PF1 


106 


5 


Vcc 


93 




nc 


107 


8 


PC2 


94 


98 


P51 


108 


11 


PC4 


95 


100 


Vss 


109 


14 


PC7 


96 


103 


AVcc 


110 


17 


PB2 


97 


106 


P41 


111 


20 


PB4 


98 


109 


P44 


112 


23 


PB7 
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Table 3-2 PGA177 to QFP128 Pin Assignment (E3471-61611)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 ">& 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
pin# 


Function 
name 


113 


26 


PA2 


127 


72 


P27 


114 


29 


PA4 


128 


75 


P24 


115 




nc 


129 


78 


P21 


116 


37 


P65 


130 


81 


RES 


117 


40 


PEO 


131 


84 


Vcc 


118 


43 


PE3 


132 


87 


Vss 


119 


46 


PE5 


133 


90 


PF6 


120 


49 


PDO 


134 


93 


PF3 


121 


52 


PD3 


135 




nc 


122 


55 


PD5 


136 


101 


P52 


123 


58 


Vcc 


137 


104 


Vref 


124 


61 


P32 


138 


107 


P42 


125 




GND 


139 


110 


P45 


126 


69 


P61 


140 


113 


AVss 
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Table 3-2 PGA177 to QFP128 Pin Assignment (E3471-61611)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
1 ">& 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
pin# 


Function 
name 


141 


116 


P16 


155 




nc 


142 


119 


P13 


156 




nc 


143 


122 


P10 


157 




nc 


144 


125 


MD2 


158 




nc 


145 




GND 


159 




nc 


146 




nc 


160 




nc 


147 




nc 


161 




GND 


148 




nc 


162 




nc 


149 




nc 


163 




nc 


150 




nc 


164 




nc 


151 




nc 


165 




nc 


152 




nc 


166 




nc 


153 




nc 


167 




nc 


154 




nc 


168 




nc 
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Table 3-2 PGA177 to QFP128 Pin Assignment (E3471-61611)(Cont'd) 



PGA 


QFP 


Function 


PGA 


QFP 


Function 


177 


128 


name 


177 


128 


name 


pin# 


pin# 




pin# 


pin# 




169 




nc 


174 




nc 


170 




nc 


175 




nc 


171 




nc 


176 




nc 


172 




nc 


177 




GND 


173 




nc 
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Table 3-3 PGA177 to QFP100 Pin Assignment (E3471-61612) 



PGA 
1 11 

LI 1 

pin# 


QFP 
inn 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
inn 

pin# 


Function 
name 


1 




nc 


15 




nc 


2 




nc 


16 




nc 


3 


96 


PG3 


17 




nc 


4 


7 


Vss 


18 




nc 


5 


32 


PCO 


19 




nc 


6 


35 


PC3 


20 


15 


PE1 


7 


37 


PC5 


21 


18 


Vss 


8 


41 


PBO 


22 


21 


PE6 


9 


44 


PB3 


23 


24 


PD1 


10 


46 


PB5 


24 




nc 


11 


50 


PAO 


25 


29 


PD6 


12 


53 


PA3 


26 


8 


P30 


13 




nc 


27 


11 


P33 


14 




nc 


28 


13 


P35 
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Table 3-3 PGA177 to QFP100 Pin Assignment (E3471-61612)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
inn 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
inn 

pin# 


Function 
name 


29 




nc 


43 




nc 


30 




nc 


44 




nc 


31 




nc 


45 


54 


P50 


32 




nc 


46 




nc 


33 




nc 


47 


59 


P53 


34 


91 


P26 


48 


79 


P40 


35 


88 


P23 


49 


82 


P43 


36 


85 


P20 


50 




nc 


37 


63 


NMI 


51 


84 


Vss 


38 


66 


XTAL 


52 


4 


P15 


39 


69 


PF7 


53 


1 


P12 


40 


71 


PF5 


54 


57 


MDO 


41 


74 


PF2 


55 


93 


PGO 


42 


76 


PFO 


56 


95 


PG2 
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Table 3-3 PGA177 to QFP100 Pin Assignment (E3471-61612)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
inn 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
inn 

pin# 


Function 
name 


57 




nc 


71 




nc 


58 


97 


PG4 


72 




nc 


59 




nc 


73 


16 


PE2 


60 


33 


PCI 


74 


19 


PE4 


61 


31 


Vss 


75 


22 


PE7 


62 


38 


PC6 


76 


25 


PD2 


63 


42 


PB1 


77 


27 


PD4 


64 


49 


Vss 


78 


30 


PD7 


65 


47 


PB6 


79 


9 


P31 


66 


51 


PA1 


80 


12 


P34 


67 




nc 


81 




nc 


68 




nc 


82 




nc 


69 




nc 


83 




nc 


70 




nc 


84 




nc 
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Table 3-3 PGA177 to QFP100 Pin Assignment (E3471-61612)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
inn 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
inn 

pin# 


Function 
name 


85 


90 


P25 


99 




nc 


86 


87 


P22 


100 


6 


P17 


87 


60 


WDTOVF 


101 


3 


P14 


88 


64 


STBY 


102 


100 


Pll 


89 


67 


EXTAL 


103 


58 


MD1 


90 




nc 


104 


94 


PG1 


91 


72 


PF4 


105 




GND 


92 


75 


PF1 


106 


98 


Vcc 


93 




nc 


107 


34 


PC2 


94 


55 


P51 


108 


36 


PC4 


95 




nc 


109 


39 


PC7 


96 


77 


AVcc 


110 


43 


PB2 


97 


80 


P41 


111 


45 


PB4 


98 




nc 


112 


48 


PB7 
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Table 3-3 PGA177 to QFP100 Pin Assignment (E3471-61612)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
inn 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
inn 

pin# 


Function 
name 


113 


52 


PA2 


127 


92 


P27 


114 




nc 


128 


89 


P24 


115 




nc 


129 


86 


P21 


116 




nc 


130 


62 


RES 


117 


14 


PEO 


131 


65 


Vcc 


118 


17 


PE3 


132 


68 


Vss 


119 


20 


PE5 


133 


70 


PF6 


120 


23 


PDO 


134 


73 


PF3 


121 


26 


PD3 


135 




nc 


122 


28 


PD5 


136 


56 


P52 


123 


40 


Vcc 


137 


78 


Vref 


124 


10 


P32 


138 


81 


P42 


125 




GND 


139 




nc 


126 




nc 


140 


83 


AVss 



3-27 In-Circuit Emulation 



Table 3-3 PGA177 to QFP100 Pin Assignment (E3471-61612)(Cont'd) 



PGA 
1 11 

LI 1 

pin# 


QFP 
inn 

pin# 


Function 
name 


PGA 

1/ / 

pin# 


QFP 
inn 

pin# 


Function 
name 


141 


5 


P16 


155 




nc 


142 


2 


P13 


156 




nc 


143 


99 


P10 


157 




nc 


144 


61 


MD2 


158 




nc 


145 




GND 


159 




nc 


146 




nc 


160 




nc 


147 




nc 


161 




GND 


148 




nc 


162 




nc 


149 




nc 


163 




nc 


150 




nc 


164 




nc 


151 




nc 


165 




nc 


152 




nc 


166 




nc 


153 




nc 


167 




nc 


154 




nc 


168 




nc 
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Table 3-3 PGA177 to QFP100 Pin Assignment (E3471-61612)(Cont'd) 



PGA 


QFP 


Function 


PGA 


QFP 


Function 


177 


100 


name 


177 


100 


name 


pin# 


pin# 




pin# 


pin# 




169 




nc 


174 




nc 


170 




nc 


175 




nc 


171 




nc 


176 




nc 


172 




nc 


177 




GND 


173 




nc 
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Electrical The AC characteristics of the HP E3471 H8S/2000 emulator are listed 

Characteristics in fliefollowin s table 

Table 3-4. Clock timing (Vcc = 5.0V, f = 20MHz) 







H8S/2655 


HP E3471A 




Characteristics 


Symbol 


Vcc = 5V 
f=20MHz 


Typical 

*1 


Worst 
Case 


Unit 






min 


max 








Clock cycle time 


tcyc 


50 


500 






ns 


Clock pulse high width 


tCH 


20 




24 


10 


ns 


Clock pulse low width 


tCL 


20 




21 


10 


ns 


Clock rise time 


tCr 




5 


2 


15 


ns 


Clock fall time 


tCf 




5 


3 


15 


ns 


Crystal oscillator setting time(reset) 


tosci 


10 




10 


10 


ms 


Crystal oscillator setting time 
(software standby) 


tOSC2 


10 




10 


10 


ms 


External clock output setting delay time 


tDEXT 


500 




500 


500 


us 



1 Typical outputs measured with 50pF load 
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Table 3-5. Control signal timing (Vcc = 5.0V, f = 20MHz) 



Characteristics 


Symbol 


H8S/2655 

Vcc = 5V 
f=20MHz 


HP 

E3471A 


Unit 

\J 1111 


Worst 
Case 


min 


max 


RES setup time 


tRESS 


200 




275 


ns 


RES pulse width 


tRESW 


9D 




20 


tcyc 


NMI reset setup time 


tNMIRS 


200 




260 


ns 


NMI reset hold time 


tNMIRH 


200 




200 


ns 


NMI setup time 


tNMIS 


150 




225 


ns 


NMI hold time 


tNMIH 


10 




10 


ns 


Interrupt pulse width 


tNMIW 


200 




235 


ns 


IRQ setup time 


tlRQS 


150 




180 


ns 


IRQ hold time 


tlRQH 


10 




10 


ns 


IRQ pulse width 


tlRQW 


200 




200 


ns 
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Table 3-6. Bus timing (Vcc = 5.0V, f = 20MHz) 



Characteristics 


Symbol 


H8S/2655 

Vcc = 5V 
f=20MHz 


HP E3471A 


Unit 


Typical 

*1 


worst 
Case 


min 


max 


Address delay time 


tAD 




20 


12 


35 


ns 


Address setup time 


tAS 


1 / \ 
1(J 




18 


-5 


ns 


Address hold time 


tAH 


15 




22 


0 


ns 


Pre- charge time 


tPCH 


55 




75 


45 


ns 


CS delay time 1 


tCSDl 






11 


35 


ns 


CS delay time 2 


tCSD2 




20 


12 


35 


ns 


CS pulse width 


tcsw 


105 




119 


95 


ns 


Address strobe delay time 


tASD 




30 


12 


45 


ns 


Read strobe delay time 1 


tRSDl 




30 


10 


45 


ns 


Read strobe delay time 2 


tRSD2 




30 


9 


45 


ns 


CAS delay time 


tCASD 




20 


11 


35 


ns 


Read data setup time 


tRDS 


15 




15* 


45 


ns 


Read data hold time 


tRDH 


0 




0* 


0 


ns 
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Table 3-6. Bus timing (Vcc = 5.0V, f = 20MHz)(Cont'd) 



Characteristics 


Symbol 


H8S/2655 

Vcc = 5V 
f=20MHz 


HP E3471A 


Unit 


Typical 

*1 


worst 
Case 


min 


max 


Read data access time 1 


tACCl 




25 


25 


-5 


ns 


Read data access time 2 


tACC2 




75 


75 


45 


ns 


Read data access time 3 


tACC3 




125 


125 


95 


ns 


Read data access time 4 


tACC4 




175 


175 


145 


ns 


Read data access time 5 


tACC5 




225 


225 


195 


ns 


WR delay time 1 


tWRDl 






12 


45 


ns 


WR delay time 2 


tWRD2 




30 


9 


45 


ns 


Write data strobe pulse width 1 


twswi 


30 




42 


20 


ns 


Write data strobe pulse width 2 


tWSW2 


55 




68 


45 


ns 


Write data delay time 


tWDD 




30 


21 


45 


ns 


Write data setup time 


tWDS 


0 




12 


-15 


ns 


Write data hold time 


tWDH 


10 




10 


-5 


ns 


WR setup time 


twcs 


15 




18 


0 


ns 


WR hold time 


tWCH 


15 




17 


0 


ns 
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Table 3-6. Bus timing (Vcc = 5.0V, f = 20MHz)(Cont'd) 







H8S/2655 


HP E3471A 




Characteristics 


Symbol 


Vcc = 5V 
f=20MHz 


Typical 

*1 


worst 
Case 


Unit 






min 


max 








CAS setup time 


tCSR 


15 




20 


0 


ns 


WAIT setup time 


tWTS 


30 




30 


60 


ns 


WAIT set hold time 


tWTH 


5 




5 


5 


ns 


BREQ setup time 


tBRQS 


30 




30 


60 


ns 


BACK delay time 


tBACD 




30 


11 


45 


ns 


Bus floating time 


tBZD 




50 


50 


65 


ns 


BREQO delay time 


tBRQOD 




30 


15 


45 


ns 



1 Typical outputs measured with 50pF load 
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Table 3-7. DMAC timing (Vcc = 5.0V, f = 20MHz) 



Characteristics 


Symbol 


H8S/2655 

Vcc = 5V 
f=20MHz 


HP 

E3471A 

Worst 
Case 


Unit 

\J 1111 


min 


max 


DREQ setup time 


tDRQS 


30 




60 


ns 


DREQ hold time 


tDRQH 


10 




10 


ns 


TEND delay time 


tTED 




30 


45 


ns 


DACK delay time 1 


tDACDl 




30 


45 


ns 


DACK delay time 2 


tDACD2 




30 


45 


ns 
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Table 3-8. Clock timing (Vcc = 3.0V, f = 10MHz) 







H8S/2655 


HP E3471A 




Characteristics 


Symbol 


Vcc = 3V 
f=10MHz 


Typical 

*1 


worst 
Case 


Unit 






min 


max 








Clock cycle time 


tcyc 


100 


500 






ns 


Clock pulse high width 


tCH 


35 




A.f\ 




ns 


Clock milse low width 

V-'XW^XV L/U±i3V^ ±W VV VV lUUi 


trr 


35 




47 


35 


ns 


Clock rise time 


tCr 




15 


4 


15 


ns 


Clock fall time 


tCf 




15 


3 


15 


ns 


Crystal oscillator setting time(reset) 


tosci 


20 




20 


20 


ms 


Crystal oscillator setting time 
(software standby) 


tOSC2 


20 




20 


20 


ms 


External clock output setting delay time 


tDEXT 


500 




500 


500 


us 



1 Typical outputs measured with 50pF load 
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Table 3-9. Control signal timing (Vcc = 3.0V, f = 10MHz) 



Characteristics 


Symbol 


H8S/2655 

Vcc = 3V 
f=10MHz 


HP 

E3471A 


Unit 

\J 1111 


Worst 
Case 


min 


max 


RES setup time 


tRESS 


200 




275 


ns 


RES pulse width 


tRESW 


9D 




20 


tcyc 


NMI reset setup time 


tNMIRS 


200 




260 


ns 


NMI reset hold time 


tNMIRH 


200 




200 


ns 


NMI setup time 


tNMIS 


150 




225 


ns 


NMI hold time 


tNMIH 


10 




10 


ns 


Interrupt pulse width 


tNMIW 


200 




235 


ns 


IRQ setup time 


tlRQS 


150 




180 


ns 


IRQ hold time 


tlRQH 


10 




10 


ns 


IRQ pulse width 


tlRQW 


200 




200 


ns 
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Table 3-10. Bus timing (Vcc = 3.0V, f = 10MHz) 



Characteristics 


Symbol 


H8S/2655 

Vcc = 3V 
f=10MHz 


HP E3471A 


Unit 


Typical 

*1 


worst 
Case 


min 


max 


Address delay time 


tAD 




40 


12 


40 


ns 


Address setup time 


tAS 


20 




43 


20 


ns 


Address hold time 


tAH 


30 




46 


25 


ns 


Pre- charge time 


tPCH 


i m 

1 10 




147 


110 


ns 


CS delay time 1 


tCSDl 




AC) 


12 


40 


ns 


CS delay time 2 


tCSD2 




40 


11 


40 


ns 


CS pulse width 


tcsw 


210 




247 


210 


ns 


Address strobe delay time 


tASD 




60 


10 


60 


ns 


Read strobe delay time 1 


tRSDl 




60 


9 


60 


ns 


Read strobe delay time 2 


tRSD2 




60 


10 


60 


ns 


CAS delay time 


tCASD 




40 


11 


40 


ns 


Read data setup time 


tRDS 


30 




30 


45 


ns 


Read data hold time 


tRDH 


0 




0 


0 


ns 
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Table 3-10. Bus timing (Vcc = 3.0V, f = 10MHz)(Cont'd) 



Characteristics 


Symbol 


H8S/2655 

Vcc = 3V 
f=10MHz 


HP E3471A 


Unit 


Typical 

*1 


worst 
Case 


min 


max 


Read data access time 1 


tACCl 




C A 

50 


50 


45 


ns 


Read data access time 2 


tACC2 




1 r\r\ 
100 


100 


95 


ns 


Read data access time 3 


tACC3 




1 cn 

150 


150 


145 


ns 


Read data access time 4 


tACC4 




200 


200 


195 


ns 


Read data access time 5 


tACC5 




250 


250 


245 


ns 


WR delay time 1 


tWRDl 






11 


60 


ns 


WR delay time 2 


tWRD2 




60 


11 


60 


ns 


Write data strobe pulse width 1 


twswi 


60 




94 


60 


ns 


Write data strobe pulse width 2 


tWSW2 


100 




144 


100 


ns 


Write data delay time 


tWDD 




60 


18 


60 


ns 


Write data setup time 


tWDS 


0 




37 


0 


ns 


Write data hold time 


tWDH 


20 




20 


20 


ns 


WR setup time 


twcs 


30 




44 


25 


ns 


WR hold time 


tWCH 


30 




43 


25 


ns 
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Table 3-10. Bus timing (Vcc = 3.0V, f = 10MHz)(Cont'd) 







H8S/2655 


HP E3471A 




Characteristics 


Symbol 


Vcc = 3V 
f=10MHz 


Typical 

*1 


worst 
Case 


Unit 






min 


max 








CAS setup time 


tCSR 


30 




44 


25 


ns 


WAIT setup time 


tWTS 


60 




60 


60 


ns 


WAIT set hold time 


tWTH 


10 




10 


10 


ns 


BREQ setup time 


tBRQS 


60 




60 


60 


ns 


BACK delay time 


tBACD 




60 


9 


60 


ns 


Bus floating time 


tBZD 




100 


100 


100 


ns 


BREQO delay time 


tBRQOD 




60 


13 


60 


ns 



1 Typical outputs measured with 50pF load 
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Table 3-1 1 . DMAC timing (Vcc = 3.0V, f = 1 0MHz) 



Characteristics 


Symbol 


H8S/2655 

Vcc = 3V 
f=10MHz 


HP 

E3471A 

Worst 
Case 


Unit 

\J 1111 


min 


max 


DREQ setup time 


tDRQS 


40 




60 


ns 


DREQ hold time 


tDRQH 


10 




10 


ns 


TEND delay time 


tTED 




60 


60 


ns 


DACK delay time 1 


tDACDl 




60 


60 


ns 


DACK delay time 2 


tDACD2 




60 


60 


ns 
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Target System 
Interface 



Vcc, Vss 



/RES, NMI, /STBY 



11 piui 11 



MDO-2 
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/WDTOVF 



K[ 



r 

i to 

-A- 



Irl 



PI, P2, P3, P5, P6, PA, PF 



T 




P3,PA, P5,P6,PB,PC, 
PD, PE, PF, PG 



-d=d-^. 



-i- 
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P4, AVcc, Vref, AVss 



Mlljill 



Aim 



HI 



-0=0 



0=f\ 



i re 1 — — 1 1 — 

Mill I- 




11 




Y 


J-Wv ■ 


* 

■ 


I 



_o- 



-j— ^ TIT 




EXTAL, XTAL Connect the circuits equivalent to those 
specified for H8/2000 series. 
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4 



Configuring the H8S/2000 Emulator 



In this chapter, we will discuss: 

■ how to configure the HP 64700 emulator for H8S/2000 
microprocessor to fit your particular measurement needs. 

■ some restrictions of HP 64700 emulator for H8S/2000 
microprocessor. 



Types of Emulator 
Configuration 



Emulation Processor 
to Emulator/Target 
System 



These are the commands which are generally thought of as 
"configuration" items in the context of other HP 64700 emulator 
systems. The commands in this group set up the relationships between 
the emulation processor and the target system, such as determining how 
the emulator responds to requests for the processor bus. Also, these 
commands determine how the emulation processor interacts with the 
emulator itself; memory mapping and the emulator's response to 
certain processor actions are some of the items which can be configured. 



These commands are the ones which are covered in this chapter. 
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Commands Which 
Perform an Action or 
Measurement 



Several of the emulator commands do not configure the emulator; they 
simply start an emulator program run or other measurement, begin or 
halt an analyzer measurement, or allow you to display the results of 
such measurements. 

These commands are covered in the examples presented in earlier 
manual chapters; they are also covered in the HP 64700 Terminal 
Interface Reference manual. 



Coordinated These commands determine how the emulator interacts with other 
Measurements measurement instruments, such as external analyzers, or other HP 

64700 emulators connected via the CMB (Coordinated Measurement 
Bus). 

These commands are covered in the HP 64700 CMB User's Guide and 
in the HP 64700 Terminal Interface Reference Manual. 



Analyzer The analyzer configuration commands are those commands which 
actually specify what type of measurement the analyzer is to make. 

Some of the analyzer commands are covered earlier in this manual. 
You can also refer to the HP 64700 Terminal Interface: Analyzer 
User's Guide and the HP 64700 Terminal Interface Reference manual. 



System This last group of commands is used by you to set the emulator's data 
communications protocol, load or dump contents of emulation 
memory, set up command macros, and so on. 

These commands are covered earlier in this manual and in the manual 
titled HP 64700 Terminal Interface: User's Reference. 
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Emulation As noted before, these commands determine how the emulation 

PrOC6SSOT tO processor will interact with the emulator's memory and the target 

" ' system during an emulation measurement. 

Emulator/Target 
System 



cf chip=2653 

cf clk=int 

cf mode=7 

cf nmi=en 

cf qbrk=dis 

cf rrt=dis 

cf rsp=0f f f f fcOO 

cf trst=en 



Cf The cf command defines how the emulation processor will respond to 
certain target system signals. 

To see the default configuration settings defined by the cf command, 
type: 

M> cf 
You will see: 



Let' s examine each of these emulator configuration options, with a 
view towards how they affect the processor's interaction with the 
emulator. 
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Cf Chip The chip configuration item defines the microprocessor you emulate. 

M> cf chip=<chip_name> 

Valid <chip_name> are the following: 



<chip_name> 


Description 




2653 


Emulate H8S/2653 


microprocessor. 


2655 


Emulate H8S/2655 


microprocessor. 


2241 


Emulate H8S/2241 


microprocessor. 


2242 


Emulate H8S/2242 


microprocessor. 


2245 


Emulate H8S/2245 


microprocessor. 


2246 


Emulate H8S/2246 


microprocessor. 



Note Mn When you use the H8S/2655 in mode 6 and map the address range of 

OlOOOOh to Olffffh as external address space, specify "2653" for the 
<chip_name>. When you map the range as internal ROM, specify 
"2655". 



Note 




The emulator does not configure the EAE bit in the system control 
register (SYSCR) automatically. Be sure to configure it manually. 



Note 




Executing this command will drive the emulator into the reset state. 
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Cf Cl k The elk (clock) option allows you to select whether the emulation 
processor's clock will be sourced by your target system or by the 
emulator. 

M> cf clk=int 

You can select the emulator's internal system clock using the above 
command. 

M> cf clk=ext 

You can specify that the emulator should use the clock input to the 
emulator probe from the target system. You must use a clock input 
conforming to the specifications of Table 4-1. 



Table 4-1. Clock Speeds 



Clock source 


With 64700A 


With 64700B 


Internal 


10MHz 


10MHz 




(System clock) 


(System clock) 


External 


From 2.0MHz up to 20MHz 


From 33kHz up to 20MHz 




(System clock) 


(System clock) 



ml 

Note SI When the emulator is connected to the target system operating at low 

voltage (2.7 to 4.5 V), the maximum system clock is 13 MHz. 



Not© Executing this command will drive the emulator into the reset state. 
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Cf mode The mode (cpu operation mode) configuration item defines operation 
mode in which the emulator works. 

M> cf mode=<mode_num> 

When <mode_num> is selected, the emulator will operate in selected 
mode regardless of the mode setting by the target system. 

Valid <mode_num> are following: 
<mode_num> Description 

1 The emulator will operate in mode 1 . (normal 
expanded mode: 8bit data bus) 

2 The emulator will operate in mode 2. (normal 
expanded mode with on-chip ROM) 

3 The emulator will operate in mode 3 . (normal 
single-chip mode) 

4 The emulator will operate in mode 4. (advanced 
expanded mode: 16bit data bus) 

5 The emulator will operate in mode 5 . (advanced 
expanded mode: 8bit data bus) 

6 The emulator will operate in mode 6. (advanced 
expanded mode with on-chip ROM) 

7 The emulator will operate in mode 7. (advanced 
single-chip mode) 



If mode '2', '3', '6' or '7' is selected and the emulation processor is 
configured no on-chip ROM type using the 'cf chip' command, the 
emulator will ignore this mode configuration option and the emulation 
processor will be operated in mode ' 1' . 



Note 



4 
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Note 




Executing this command will drive the emulator into the reset state. 



cf nmi The nmi (non maskable interrupt) configuration item determines 

whether or not the emulator responds to NMI signal from the target 
system during foreground operation. 

M> cf nmi=en 

Using the above command, you can specify that the emulator will 
respond to NMI from the target system. 

M> cf nmi=dis 

The emulator won't respond to NMI from the target system. 

The emulator does not accept any interrupt while in background 
monitor. Such interrupts are suspended while running the background 
monitor, and will occur when context is changed to foreground. 



Note 




Executing this command will drive the emulator into the reset state. 



Cf qbrk The qbrk(quick temporary break) configuration item specifies to use 
quick temporary break or not. 

M> cf qbrk=en 

Setting qbrk equal to en specifies that a temporary break to the monitor 
for an operation such as display registers will spend a very small 
amount of time in the monitor. The CMB does not work in this setting. 

M> cf qbrk=dis 

Setting qbrk equal to dis specifies that a temporary break to the monitor 
will spend more time in the monitor. 
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Note 




Execution of this configuration option will drive the emulator into a 
reset state. 



Cf ITt The rrt (restrict to real time) option lets you configure the emulator so 
that commands which cause the emulator to break to monitor and 
return to the user program will be rejected by the emulator command 
interpreter. 

M> cf rrt=en 



You can restrict the emulator to accepting only commands which don't 
cause temporary breaks to the monitor by entering the above command. 
Only the following emulator run/stop commands will be accepted: 

rst (resets emulation processor) 

b (breaks processor to background monitor until you enter another 
command) 

r (runs the emulation processor from a given location) 

s (steps the processor through a piece of code -- returns to monitor after 
each step) 

Commands which cause the emulator to break to the monitor and 
return, such as reg, m (for target memory display), and others will be 
rejected by the emulator. 



0 



Caution Wtlk ^ y° ur tar g et system circuitry is dependent on constant execution of 

program code, you should set this option to cf rrt=en. This will help 
insure that target system damage doesn't occur. However, remember 
that you can still execute the rst, b and s commands; you should use 
caution in executing these commands. 



M> cf rrt=dis 
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When you use this command, all commands, regardless of whether or 
not they require a break to the emulation monitor, are accepted by the 
emulator. 

Cf TSp The rsp (reset stack pointer) configuration item allows you to specify a 
value to which the stack pointer will be set upon the transition from 
emulation reset into the emulation monitor. 

R> cf rsp=XXXXXXXX 

where XXXXXXXX is a 32-bit even address, will set the stack pointer 
to that value upon entry to the emulation monitor after an emulation 
reset. You cannot set rsp at the following location. 

■ Odd address 

■ Internal I/O register area 

For example, to set the stack pointer to OffOO hex, type: 
R> cf rsp=0ff00 

Now, if you break the emulator to monitor using the b command, the 
stack pointer will be modified to the value OffOO hex. 



Note atei Without a stack pointer, the emulator is unable to make the transition to 

«y the run state, step, or perform many other emulation functions. 

However, using this option does not preclude you from changing the 
stack pointer value or location within your program; it just sets the 
initial conditions to allow a run to begin. 



Cf tfSt The trst (target reset) configuration item allows you to specify whether 
or not the emulator responds to /RES and /STB Y signals from the 
target system during foreground operation. When running the 
background monitor, the emulator ignores such signals. 

M> cf trst=en 

When you enable target system reset with the above command, the 
emulator will respond to /RES input during foreground operation. 

M> cf trst=dis 
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When disabled, the emulator won't respond to /RES and /STBY inputs 
from the target system. 



4 



Note <|1P /RES and /STBY signals are always ignored during background 

operation regardless of this configuration. 



Note Msl The H8S/2000 emulator dose not support hardware standby mode, and 



1 



/STBY input will be given the emulator /RES input. 



•J 

Note SI Executing this command will drive the emulator into the reset state. 
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Memory Mapping Before you begin an emulator session, you must specify the location 

and type of various memory regions used by your programs and your 
target system (whether or not it exists). You do this for several reasons: 

■ the emulator must know whether a given memory location 
resides in emulation memory or in target system memory. This 
allows the emulator to properly orient buffers for the given 
data transfer. 

■ the emulator needs to know the size of any emulation memory 
blocks so it can properly reserve emulation memory space for 
those blocks. 

■ the emulator must know if a given space is RAM (read/write), 
ROM (read only), or doesn't exist. This allows the emulator to 
determine if certain actions taken by the emulation processor 
are proper for the memory type being accessed. For example, 
if the processor tries to write to a emulation memory location 
mapped as ROM, the emulator will not permit the write (even 
if the memory at the given location is actually RAM). (You 
can optionally configure the emulator to break to the monitor 
upon such occurrence with the be -e rom command.) Also, if 
the emulation processor attempts to access a non existent 
location (known as "guarded"), the emulator will break to the 
monitor. 

You use the map command to define memory ranges and types for the 
emulator. The H8S/2000 emulator memory mapper allows you to 
define up to 16 different map terms; each map term has a minimum size 
of IK bytes. If you specify a value less than IK bytes, the emulator will 
automatically allocate an entire block. You can specify one of five 
different memory types (erom, eram, trom, tram, grd). 

For example, you might be developing a system with the following 
characteristics: 

■ input port at OfOOO hex 

■ output port at Of 100 hex 

■ program and data from 1000 through 3fff hex 
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Suppose that the only thing that exists in your target system at this time 
are input and output ports and some control logic; no memory is 
available. You can reflect this by mapping the I/O ports to target 
system memory space and the rest of memory to emulation memory 
space. Type the following commands: 

R> map Of 000.. Of 100 tram 
R> map 1000.. 3fff eram 
R> map 

# remaining number of terms : 14 

# remaining emulation memory : 3a000h bytes 
map 001000 .. 003fff eram # term 1 

map OOf 000 . . OOf If f tram # term 2 

map other tram 

As you can see, the mapper rounded up the second term to 5 12 bytes 
block, since those are minimum size blocks supported by the H8S/2000 
emulator. 



4 



Note MSa When you use the internal ROM, you must map that area to emulation 

memory. When you power on the emulator, all memory space except 
internal RAM is mapped to target RAM. Therefore, if you don't map 
internal ROM properly, you cannot access that area. 



4 



Note Ml You don't have to map internal RAM as emulation RAM, since the 

H8S/2000 emulator automatically maps internal RAM as emulation 
RAM and this area is behaved like internal RAM. However emulation 
memory system does not introduce internal RAM area in memory 
mapping display. 
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Note MBl If you map internal RAM area as emulation memory, this area is 
behaved like external memory overlapped with internal RAM. 
However the H8S/2000 emulator is always accessed internal RAM area 
mapped by the emulator. And if you map internal RAM as guarded 
memory, the emulator prohibits to access to this area by m commands. 



Note I You should map all memory ranges except internal RAM used by your 

programs before loading programs into memory. This helps safeguard 
against loads which accidentally overwrite earlier loads if you follow a 
map/load procedure for each memory range. 



Note 




Executing this command will drive the emulator into the reset state. 



For further information on mapping, refer to the examples in earlier 
chapters of this manual and to the HP 64700 Terminal Interface User's 
Reference manual. 

Break Conditions The be command lets you configure the emulator's response to various 

emulation system and external events. 

Write to ROM 

If you want the emulator to break into the emulation monitor whenever 
the user program attempts to write to a memory region mapped as 
ROM, enter: 

M> be -e rom 

You can disable this function by entering: 
M> be -d rom 

When disabled, the emulator will not break to the monitor upon a write 
to ROM. 
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Note Ifil If emulator writes to the memory mapped as ROM or guarded area in 
a*T internal DMA cycles, the emulator will not break to the monitor 

regardless of this configuration. 



Software Breakpoints 

The bp command allows you to insert software traps in your code 
which will cause a break to the emulation monitor when encountered 
during program execution. If you want to enable the insertion and use 
of software breakpoints by the bp command, enter: 

M> be -e bp 

To disable use of software breakpoints, type: 
M> be -d bp 

Any breakpoints which previously existed in memory are disabled, but 
are not removed from the breakpoint table. 

Trigger Signals 

The HP 64700 emulator provides four different trigger signals which 
allow you to selectively start or stop measurements depending on the 
signal state. These are the bnct (rear panel BNC input), cmbt (CMB 
trigger input), trigl and trig2 signals (provided by the analyzer). 

You can configure the emulator to break to the monitor upon receipt of 
any of these signals. Simply type: 

M> be -e <signal> 

For example, to have the emulator break to monitor upon receipt of the 
trigl signal from the analyzer, type: 

M> be -e trigl 

(Note: in this situation, you must also configure the analyzer to drive 
the trigl signal upon finding its trigger by entering tgout trigl). 
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Where to Find 
More Information 



Due to the architecture of the HP 64700 emulators, there are a wide 
variety of items that affect how the emulator interacts with your 
system, controller, and other measuring instruments. If you need more 
configuration information, we suggest the following strategy: 



If you need tutorial information ■ 



■ Emulator: look at this manual. 



■ Analyzer: look at the. Analyzer User's Guide and this manual. 



■ CMB: look at the CMB User's Guide. 
If you need reference information — 



■ Look at the Terminal Interface User's Reference manual (also 
contains some examples). 
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Notes 
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A 



H8S/2000 Emulator Specific Command Syntax 



The following pages contain descriptions of command syntax specific 
to the H8S/2000 emulator. The following syntax items are included 
(several items are part of other command syntax): 

■ <CONFIG_ITEMS>. May be specified in the cf (emulator 
configuration) and help cf commands. 

■ <ADDRESS>. May be specified in emulation commands 
which allow addresses to be entered. 

■ <REG_NAME>. May be specified in the reg (register) 
command. 

Command and error messages which are specific to the H8S/2000 
emulator are also described in this chapter. 
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CONFIG ITEMS 



Summary H8S/2000 emulator configuration items. 



Syntax 



rrt" 



trst" 



b a 



dbc 



n m 



tdma 



t rf sh 



elk > 



chip )- 



mode }- 



/- S : 




d i s J- 



) 



< ch 1 p n ame : 



<made num> 



* < HDDRESS- 
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Description The H8S/2000 emulator has several dedicated configuration items 
which allow you to specify the emulator' s interaction with the target 
system and the rest of the emulation system. These items are: 



chip Select processor to be emulated. 

elk Select internal/external clock source. 

mode Determine emulator processor operation mode. 

nmi Enable/disable NMI (non maskable interrupt) from 

target system. 

qbrk Enable/disable quick temporary break. 

rrt Restrict emulator to real time runs. 

rsp Specify system stack pointer value to load upon 

each transition from emulation reset to the monitor. 

trst Enable/disable target system reset. 



Complete explanations of all configuration items are given in chapter 4 
of this manual. 
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Examples 



To select an external clock, type: 



M> cf clk=ext 

You can obtain the status of configuration items by typing the item 
name without a value. You can also specify multiple configuration 
items on the same line. Type: 

M> cf nmi=dis rrt=dis elk 

cf clk=ext 



Related information Refer to the cf syntax pages in the User's Reference manual. Also, refer 

to chapter 3 of this manual for complete information about each 
configuration item. 



ADDRESS 

Summary Address specification used in emulation commands. 



Description The <ADDRESS> parameter used in emulation commands is specified 
in 24 bits address information. 



Examples m 1000 

m 200000..2000ff 



A-4 H8/3003 Emulator Specific Command Syntax 



REGISTER CLASS 
and NAME 



Summary H8S/2000 register designators. All available register class names and 



register names are listed below. 


<REG_CLASS> 




<REG_NAME> 


Description 


* (All basic registers) 


pc 


Program counter 


ccr 


Condition code register 


exr 


Extended register 


erO 


Register ERO 


erl 


Register ER1 


er2 


Register ER2 


er3 


Register ER3 


er4 


Register ER4 


er5 


Register ER5 


er6 


Register ER6 


er7 


Register ER7 


sp 


Stack pointer 


mach 


Multiply and accumulate register H 


macl 


Multiply and accumulate register L 


m dcr 


Mode control register(Read Only) 


sys (System control) 


sbycr 


Stand-by control register 


syscr 


System control register 


sckcr 


System clock control register 


mdcr 


Mode control register(Read Only) 


mstpcr 


Module stop control register 


lpwcr 


Low power control register 
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intc (Interrupt controller) 


syscr 


System control register 


iscr 


IRQ sense control register 


ier 


IRQ enable register 


isr 


IRQ status register 


icra 


Interrupt control register A 


icrb 


Interrupt control register B 


icrc 


Interrupt control register C 


ipra 


Interrupt priority register A 


iprb 


Interrupt priority register B 


iprc 


Interrupt priority register C 


iprd 


Interrupt priority register D 


ipre 


Interrupt priority register E 


iprf 


Interrupt priority register F 


iprg 


Interrupt priority register G 


iprh 


Interrupt priority register H 


ipri 


Interrupt priority register I 


iprj 


Interrupt priority register J 


iprk 


Interrupt priority register K 


busc (Bus controller) 


abwcr 


Byte/Word area control register 


aster 


2/3 state area control register 


wcr 


Wait control register 


bcrh 


Bud control register H 


bcrl 


Bud control register L 


mcr 


Memory control register 


dramcr 


DRAM control register 


rtcnt 


Refresh timer counter register 


rtcor 


Refresh timer constant register 
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dmacg (DMA controller general) 



dmawer DMA write enable register 

dmatcr DMA terminal control register 

dmacrOa DMA control register OA 

dmacrOb DMA control register OB 

dmacrl a DMA control register 1 A 

dmacrlb DMA control register IB 

dmabcr DMA band control register 

dmacO (DMA controller 0) 

marOa Memory address register OA 

ioarOa I/O address register OA 

etcrOa Transfer count register OA 

marOb Memory address register OB 

ioarOb Transfer count register OB 

etcrOb I/O address register OB 

dmad (DMA controller 1) 

marl a Memory address register 1 A 

ioarla I/O address register 1 A 

etcr 1 a Transfer count register 1 A 

marlb Memory address register IB 

ioarlb Transfer count register IB 

etcrlb I/O address register IB 

dtc (Data transfer controller) 

dtcera DTC enable register A 

dtcerb DTC enable register B 

dtcerc DTC enable register C 

dtcerd DTC enable register D 

dtcere DTC enable register E 

dtcerf DTC enable register F 

dtvect DTC vector register 
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port (I/O port) 



plddr Port 1 data direction register( Write Only) 

p2ddr Port 2 data direction register(Write Only) 

p3ddr Port 3 data direction register(Write Only) 

p5ddr Port 5 data direction register(Write Only) 

p6ddr Port 6 data direction register(Write Only) 

paddr Port A data direction register(Write Only) 

pbddr Port B data direction register(Write Only) 

pcddr Port C data direction register(Write Only) 

pdddr Port D data direction register(Write Only) 

peddr Port E data direction register(Write Only) 

pfddr Port F data direction register(Write Only) 

pgddr Port G data direction register(Write Only) 

pldr Port 1 data register 

p2dr Port 2 data register 

p3dr Port 3 data register 

p5dr Port 5 data register 

p6dr Port 6 data register 

padr Port A data register 

pbdr Port B data register 

pcdr Port C data register 

pddr Port D data register 

pedr Port E data register 

pfdr Port F data register 

pgdr Port G data register 

portl Port 1 register(Read Only) 

port2 Port 2 register(Read Only) 

port3 Port 3 register(Read Only) 

port4 Port 4 register(Read Only) 

port5 Port 5 register(Read Only) 

port6 Port 6 register(Read Only) 

porta Port A register(Read Only) 

portb Port B register(Read Only) 

portc Port C register(Read Only) 

portd Port D register(Read Only) 

porte Port E register(Read Only) 

portf Port F register(Read Only) 

portg Port G register(Read Only) 
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paper Port A pull-up MOS control register 

pbper Port B pull-up MOS control register 

peper Port C pull-up MOS control register 

pdper Port D pull-up MOS control register 

pepcr Port E pull-up MOS control register 

p3odr Port 3 open drain control register 

paodr Port A open drain control register 



ipug (16 bit integrated timer pulse unit general) 



tstr 


Timer start register 


tsyr 


Timer synchro register 


ipuO (16 bit integrated timer pulse unit 0) 


tcrO 


Timer control register 0 


tmdrO 


Timer mode register 0 


tiorO 


Timer I/O control register 0 


tierO 


Timer interrupt enable register 0 


tsrO 


Timer status register 0 


ten tO 


Timer counter 0 


tgrOa 


Timer general register OA 


tgrOb 


Timer general register OB 


tgrOc 


Timer general register 0C 


tgrOd 


Timer general register 0D 


ipul (16 bit integrated timer pulse unit 1) 


tcrl 


Timer control register 1 


tmdrl 


Timer mode register 1 


tiorl 


Timer I/O control register 1 


tierl 


Timer interrupt enable register 1 


tsrl 


Timer status register 1 


tcntl 


Timer counter 1 


tgrla 


Timer general register 1A 


tgrlb 


Timer general register IB 


tgrlc 


Timer general register 1C 


tgrld 


Timer general register ID 
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ipu2 (16 bit integrated timer pulse unit 2) 



tcr2 


Timer 


tmdr2 


Timer 


tior2 


Timer 


tier2 


Timer 


tsr2 


Timer 


tcnt2 


Timer 


tgr2a 


Timer 


tgr2b 


Timer 


tgr2c 


Timer 


tgr2d 


Timer 



control register 2 
mode register 2 
I/O control register 2 
interrupt enable register 2 
status register 2 
counter 2 

general register 2A 
general register 2B 
general register 2C 
general register 2D 



ipu3 (16 bit integrated timer pulse unit 3) 



tcr3 


Timer 


tmdr3 


Timer 


tior3 


Timer 


tier3 


Timer 


tsr3 


Timer 


tcnt3 


Timer 


tgr3a 


Timer 


tgr3b 


Timer 


tgr3c 


Timer 


tgr3d 


Timer 



control register 3 
mode register 3 
I/O control register 3 
interrupt enable register 3 
status register 3 
counter 3 

general register 3A 
general register 3B 
general register 3C 
general register 3D 



ipu4 (16 bit integrated timer pulse unit 4) 



tcr4 


Timer 


tmdr4 


Timer 


tior4 


Timer 


tier4 


Timer 


tsr4 


Timer 


tcnt4 


Timer 


tgr4a 


Timer 


tgr4b 


Timer 


tgr4c 


Timer 


tgr4d 


Timer 



control register 4 
mode register 4 
I/O control register 4 
interrupt enable register 4 
status register 4 
counter 4 

general register 4A 
general register 4B 
general register 4C 
general register 4D 
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ipu5 (16 bit integrated timer pulse unit 5) 



tcr5 Timer control register 5 

tmdr5 Timer mode register 5 

tior5 Timer I/O control register 5 

tier5 Timer interrupt enable register 5 

tsr5 Timer status register 5 

tcnt5 Timer counter 5 

tgr5a Timer general register 5A 

tgr5b Timer general register 5B 

tgr5c Timer general register 5C 

tgr5d Timer general register 5D 

ppc (Programable pulse generator) 

per TPC output control register 

pmr TPC output mode register 

nder Next data enable register 

podr Output data register 

ndrh Next data register H (address: 0xxff4ch) 

ndrl Next data register L (address: 0xxff4dh) 

ndrh2 Next data register H (address: 0xxff4eh) 

ndrlO Next data register L (address: 0xxff4fh) 

tmrO (8 bit timer 0) 

ttcrO Timer control register 0 

ttcsrO Timer control/status register 0 

ttcoraO Timer constant register AO 

ttcorbO Timer constant register BO 

ttcntO Timer counter register 0 

tmrl (8 bit timer 1) 

ttcrl Timer control register 1 

ttcsrl Timer control/status register 1 

ttcoral Timer constant register Al 

ttcorb 1 Timer constant register B 1 

ttcntl Timer counter register 1 
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wdt (Watch dog timer) 



wdtcsr Timer control/status register 

wdtent Timer counter register 

rstcsr Reset control/status register 

sciO (Serial communication interface 0) 

smrO Serial mode register 0 

brrO B it rate register 0 

scrO Serial control register 0 

tdrO Transmit data register 0 

ssrO Serial status register 0 

rdrO Receive data register 0 (Read Only) 

scmrO Smart card mode register 0 

scil (Serial communication interface 1) 

smrl Serial mode register 1 

brrl Bit rate register 1 

scrl Serial control register 1 

tdrl Transmit data register 1 

ssrl Serial status register 1 

rdrl Receive data register 1 (Read Only) 

scmrl Smart card mode register 1 

sci2 (Serial communication interface 2) 

smr2 Serial mode register 2 

brr2 B it rate register 2 

scr2 Serial control register 2 

tdr2 Transmit data register 2 

ssr2 Serial status register 2 

rdr2 Receive data register 2 (Read Only) 

scmr2 Smart card mode register 2 
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adc (A/D converter) 



addra A/D data register A(Read Only) 

addrb A/D data register B(Read Only) 

addrc A/D data register C(Read Only) 

addrd A/D data register D(Read Only) 

addre A/D data register E(Read Only) 

addrf A/D data register F(Read Only) 

addrg A/D data register G(Read Only) 

addrh A/D data register D(Read Only) 

adcsr A/D data register D(Read Only) 

adcr A/D control/status register 
A/D control register 

dac (D/A converter) 

dadrO D/A data register 0 

dadrl D/A data register 1 

dacr D/A control register 
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NOCLASS 



The following register names are not included in any register class. 



rO 


Register RO 


rl 


Register Rl 


r2 


Register R2 


r3 


Register R3 


r4 


Register R4 


r5 


Register R5 


r6 


Register R6 


r7 


Register R7 


eO 


Register EO 


el 


Register El 


e2 


Register E2 


e3 


Register E3 


e4 


Register E4 


e5 


Register E5 


e6 


Register E6 


e7 


Register E7 


rOh 


Register ROH 


rOl 


Register ROL 


rlh 


Register R1H 


rll 


Register R1L 


r2h 


Register R2H 


r21 


Register R2L 


r3h 


Register R3H 


r31 


Register R3L 


r4h 


Register R4H 


r41 


Register R4L 


r5h 


Register R5H 


r51 


Register R5L 


r6h 


Register R6H 


r61 


Register R6L 


r7h 


Register R7H 


r71 


Register R7L 
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Emulator Specific 
Error Messages 



The following is the error messages which are specific to the H8S/2000 
emulator. The cause of the errors is described, as well as the action you 
must take to remedy the situation. 



Message 140 : Invalid address for run or step in current mode 



Cause 

This error occurs when you attempt to execute user program (with r or 
s command) from address over area of current mode. 

Message 141 : Use register command to modify I/O registers 



Cause 

This error occurs when you attempt to modify the internal I/O register 
using the m or load command. 

Message 170 : Copy target image not supported 



Cause 

This error occurs when you attempt to execute the cim command. 
Message 178 : Update HP64700 system firmware to A.04.00 or newer 



Cause 

This error occurs when the version of the controller firmware you use is 
earlier than A.04.00. 
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Message 179 : Memory module not found 

Cause 

This error occurs when no memory module is connected or when a 
memory module not supported is connected. 
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Index 



A ADDRESS syntax, A-4 
Analyzer 

configuration, 2-20 
configuration commands, 4-2 
matters to be attended to, 2-25 
storage specification, 2-20 - 2-21 
trace, 2-19 

trace list display, 2-21 
trace list format, 2-21 
trigger, 2-20 

trigger specification, 2-20 

triggering by data, 2-29 
analyzer status 

predefined equates, 2-20 
Analyzer trace 

starting, 2-21 

B b Command, 2-16 

be Command, 2-10, 2-23, 4-13 
Before using the emulator, 2-2 
bp Command, 2-23, 4-14 
Break 

write to ROM, 4-13 
Break condition, 2-23 
Breaks, 4-13 

C cf chip Command, 4-4 
cf elk Command, 4-5 
cf Command, 2-9, 4-3 
cf mode Command, 4-6 
cf nmi Command, 4-7 
cf qbrk Command, 4-7 
cf rrt Command, 4-8 
cf rsp Command, 4-9 
cf trst Command, 4-9 
cim Command, 2-23 
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Clock selection for microprocessor, 4-5 
Command help, 2-7 
Command prompts, 2-16 

Command syntax, specific to H8S/2000 emulator, A-l 
Commands 

analyzer configuration, 4-2 

b, 2-16 

be, 2-10, 2-23, 4-13 

bp, 2-23, 4-14 

cf, 2-9, 4-3 

cf chip, 4-4 

cf elk, 4-5 

cf mode, 4-6 

cf nmi, 4-7 

cf qbrk, 4-7 

cfrrt, 4-8 

cf rsp, 4-9 

cf trst, 4-9 

cim, 2-23 

configuration, 4-1 

coordinated measurement, 4-2 

help, 2-7 

init, 2-8 

m, 2-12, 2-18 

map, 2-11, 4-11 

measurement, 4-2 

r, 2-16 - 2-17 

reg, 2-17 

rst, 2-16 

s, 2-19 

ser, 2-25 

system, 4-2 

t, 2-21 

tf, 2-21 

tg.2-21 

tinit, 2-25 

tl, 2-21 

tp, 2-26 

tsto, 2-21, 2-27 
CONFIGJTEMS syntax, A-2 
Configuration 
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analyzer, 4-2 
breaks, 4-13 
clock selection, 4-5 
displaying, 4-3 

enable/disable target interrupts, 4-7 

enable/disable target system reset, 4-9 

for getting started, 2-9, 2-11 

hardware standby, 4-10 

internal RAM, 4-12 

measurement commands, 4-2 

memory mapping, 4-11 

microprocessor operation mode, 4-6 

microprocessor selection, 4-4 

processor to emulator/target system, 4-1, 4-3 

quick temporaray break, 4-7 

restrict to real-time runs, 4-8 

stack pointer, 4-9 

system, 4-2 

to access the internal ROM, 4-12 
types of, 4-1 
Coordinated measurement commands, 4-2 

D Displaying 

configuration, 4-3 
memory, 2-18 
registers, 2-17 
trace list, 2-21 

E electrical characteristics, 3-30 
Emulator 

configuration, 2-9, 2-11 

initialization, 2-8 

purpose, 1-1 
Emulator features, 1-3 

analyzer, 1-5 

breakpoints, 1-5 

clock speeds, 1-4 

emulation memory, 1-5 

processor reset control, 1-6 

register display /modify, 1-5 

restrict to real-time runs, 1-6 

supported microprocessors, 1-3 
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Emulator limitations, 1-7 
Emulator specific command syntax, A-l 
equates predefined for analyzer status, 2-20 
Evaluation chip, 1-8 

F Function codes 

memory mapping, 4-11 

H H8S/2000 microprocessor 

installation procedure, 3-6 
Help, 2-7 

help Command, 2-7 

I In-circuit emulation 

installing the PGA adapter, 3-4 

QFP cable, 3-3 

QFP socket/adapter, 3-3 
Information help, 2-7 
init Command, 2-8 
Initializing the Emulator, 2-8 
installing H8S/2000 microprocessor, 3-6 
Installing target system probe 

target system probe, 3-2 
internal RAM 

mapping, 4-12 
Internal ROM access, 4-12 
Interrupts 

enable/disable from target system, 4-7 

L labels (trace), predefined, 2-19 

limitations 

DMA support, 1-7 

Hardware standby mode, 1-7, 4-10 

Interrupts in background, 1-7 

Sleep/standby mode, 1-7 

store condition and trace, 2-27 

Watch dog timer in background, 1-7 

Loading programs, 2-12 

for Standalone Configuration, 2-12 

M m Command, 2-12, 2-18 
map Command, 2-11, 4-11 
mapping of internal RAM, 4-12 
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Measurement commands, 4-2 
Memory Display, 2-18 

mnemonic format, 2-15 
Memory mapping, 4-11 

defining memory type to emulator, 4-11 

function codes, 4-11 

sequence of map/load commands, 4-13 
Memory search, 2-25 
Mnemonic display format, 2-15 

N notes 

/STB Y input will give the emulator /RES input, 4-10 
mapping of internal RAM, 4-12 

P PGA adapter 

installation procedure, 3-4 
PGA pin assignment, 3-8 
predefined equates, 2-20 
predefined trace labels, 2-19 
Predefining stack pointer, 4-9 
Prerequisites for using the emulator, 2-2 
Processor clock selection, 4-5 
Program loads, 2-12 
Program tracing, 2-19 
Prompts 

emulator command, 2-16 
Purpose of the Emulator, 1-1 

Q QFP cable, 3-3 

QFP socket/adapter, 3-3 
quick temporary break, 4-7 

R r Command, 2-16 - 2-17 
Real-time runs 

restricting emulator to, 4-8 
reg Command, 2-17 
REGISTER CLASS, A-5 
Register Display, 2-17 
REGISTER NAME , A-5 
Restrict to real time runs, 4-8 

permissible commands, 4-8 

target system dependency, 4-8 
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rst Command, 2-16 
run from reset, 3-7 



S s Command, 2-19 
Sample programs 

for getting started, 2-3 
ser Command, 2-25 
Single step, 2-19 
Software breakpoints, 2-23, 4-14 

defining in target ROM, 2-23 
Stack pointer 

predefining, 4-9 
Starting a trace, 2-21 

stat (emulation analyzer status) trace label, 2-20 
Storage qualifier, 2-21 

Syntax (command), specific to H8S/2000 emulator, A-l 
System commands, 4-2 

T t Command, 2-21 
target system 

interface, 3-42 

QFP cable, 3-3 
Target system dependency on executing code, 4-8 
Target system interrupts 

enable/disable, 4-7 
Target system probe 

installation, 3-2 
target system reset, 4-9 

run from reset, 3-7 
tf Command, 2-21 
tg Command, 2-21 
tinit Command, 2-25 
tl Command, 2-21 

tlb (display/modify trace labels) command, 2-19 

tp Command, 2-26 

trace labels, predefined, 2-19 

Trace list display, 2-21 

Trace list format, 2-21 

Tracing program execution, 2-19 

Trigger signals 

break upon, 4-14 
tsto Command, 2-21 
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effect on the analyzer, 2-27 
Types of configuration, 4-1 
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